{"id":"CVE-2016-4476","aliases":["ALPINE-CVE-2016-4476","DEBIAN-CVE-2016-4476","DLA-473-1","EUVD-2016-5463","GHSA-p986-2574-rgvr","MGASA-2016-0199","UBUNTU-CVE-2016-4476","USN-3455-1","openSUSE-SU-2024:10022-1","openSUSE-SU-2024:10499-1"],"status":"published","title":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters...","description":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02858,"percentile":0.86834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-05-09T00:00:00Z","modified":"2026-09-22T07:01:04Z","fixes":[{"ecosystem":"Alpine:v3.4","package":"wpa_supplicant","fixed_in":["2.5-r3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wpa","fixed_in":["2.3-2.4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wpa","fixed_in":["2.3-2.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wpa","fixed_in":["2.3-2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"wpa","fixed_in":["2.1-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"wpa","fixed_in":["2.4-0ubuntu6.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"wpa","fixed_in":["2.4-0ubuntu10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.4","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.7"},{"fixed":"2.5-r3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2.4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2.4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-2.4"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0-3+deb7u4"}]}],"versions":["1.0-3","1.0-3+deb7u1","1.0-3+deb7u2","1.0-3+deb7u3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-3.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-0ubuntu1.5"}]}],"versions":["1.0-3ubuntu2","1.0-3ubuntu3","1.0-3ubuntu4","2.1-0ubuntu1","2.1-0ubuntu1.1","2.1-0ubuntu1.2","2.1-0ubuntu1.3","2.1-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-0ubuntu6.2"}]}],"versions":["2.4-0ubuntu3","2.4-0ubuntu4","2.4-0ubuntu5","2.4-0ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-0ubuntu10"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-0ubuntu1.5"}]}],"versions":["1.0-3ubuntu2","1.0-3ubuntu3","1.0-3ubuntu4","2.1-0ubuntu1","2.1-0ubuntu1.1","2.1-0ubuntu1.2","2.1-0ubuntu1.3","2.1-0ubuntu1.4"],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4-0ubuntu6.2"}]}],"versions":["2.4-0ubuntu3","2.4-0ubuntu4","2.4-0ubuntu5","2.4-0ubuntu6"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hostapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wpa_supplicant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-1.1"}]}],"bundled":13}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"w1.fi","product":"hostapd"},{"vendor":"w1.fi","product":"wpa_supplicant"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/05/03/12","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-3455-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4476"},{"url":"https://github.com/advisories/GHSA-p986-2574-rgvr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-4476","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4476","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0199.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18335","tags":["report"]},{"url":"http://w1.fi/security/2016-1/psk-parameter-config-update.txt","tags":["web","report"]},{"url":"https://ubuntu.com/security/CVE-2016-4476","tags":["report"]},{"url":"http://w1.fi/security/2016-1/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3455-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4476","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13078","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13081","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13086","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13088","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4477","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4476","description":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.","status":"published","published":"2016-05-09T10:00:00Z","modified":"2024-08-06T00:32:25.406Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5463","description":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.","status":"published","published":"2016-05-09T10:00:00Z","modified":"2024-08-06T00:32:25Z","updated_at":"2026-11-03T02:22:46.329763Z"}],"ghsa":[{"id":"GHSA-p986-2574-rgvr","title":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters...","description":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.","status":"published","published":"2022-05-13T01:23:51Z","modified":"2023-02-01T05:07:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:50:31.687075Z"}],"nvd":[{"id":"CVE-2016-4476","description":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.","status":"published","published":"2016-05-09T10:59:41.813Z","modified":"2026-06-17T00:47:37.83Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"ALPINE-CVE-2016-4476","description":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.","status":"published","published":"2016-05-09T10:59:41.813Z","modified":"2026-09-22T06:17:50.324179702Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-4476","description":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.","status":"published","published":"2016-05-09T10:59:41.813Z","modified":"2026-04-16T06:17:36.617257607Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4476","description":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.","status":"published","published":"2016-05-09T10:59:41.813Z","modified":"2026-09-22T07:01:04.382580062Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4476","description":"hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.","status":"published","published":"2016-05-09T00:00:00Z","modified":"2026-02-04T03:10:52.795387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-473-1","title":"wpa - security update","status":"published","published":"2016-05-14T00:00:00Z","modified":"2026-03-09T02:09:31.947488Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"MGASA-2016-0199","title":"Updated wpa_supplicant packages fix security vulnerabilities","description":"Updated wpa_suppliant packages fix security vulnerabilities:\n\nA vulnerability was found in how wpa_supplicant writes the configuration file\nupdate for the WPA/WPA2 passphrase parameter. If this parameter has been\nupdated to include control characters either through a WPS operation\n(CVE-2016-4476) or through local configuration change over the wpa_supplicant\ncontrol interface (CVE-2016-4477), the resulting configuration file may prevent\nthe wpa_supplicant from starting when the updated file is used. In addition, it\nmay be possible to load a local library file and execute code from there with\nthe same privileges under which the wpa_supplicant process runs.\n","status":"published","published":"2016-05-21T22:11:24Z","modified":"2026-04-16T06:24:10.188206983Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10022-1","title":"hostapd-2.6-1.1 on GA media","description":"These are all security issues fixed in the hostapd-2.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:19.130148Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10499-1","title":"wpa_supplicant-2.6-1.1 on GA media","description":"These are all security issues fixed in the wpa_supplicant-2.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:03.526024Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-3455-1","title":"wpa vulnerabilities","description":"Mathy Vanhoef discovered that wpa_supplicant and hostapd incorrectly\nhandled WPA2. A remote attacker could use this issue with key\nreinstallation attacks to obtain sensitive information. (CVE-2017-13077,\nCVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081,\nCVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088)\n\nImre Rad discovered that wpa_supplicant and hostapd incorrectly handled\ninvalid characters in passphrase parameters. A remote attacker could use\nthis issue to cause a denial of service. (CVE-2016-4476)\n\nImre Rad discovered that wpa_supplicant and hostapd incorrectly handled\ninvalid characters in passphrase parameters. A local attacker could use\nthis issue to cause a denial of service, or possibly execute arbitrary\ncode. (CVE-2016-4477)\n","status":"published","published":"2017-10-16T15:39:35Z","modified":"2026-02-10T04:41:13Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}