{"id":"CVE-2026-127029","summary":"Freeradius: stack-based buffer overflow via unbounded eap-sim identity length","details":"A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).","modified":"2026-11-14T13:28:08.710660380Z","published":"2026-11-12T16:21:48.973Z","database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127029.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-127029"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127029.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127029"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572339"},{"type":"FIX","url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"type":"FIX","url":"https://github.com/FreeRADIUS/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freeradius/freeradius-server","events":[{"introduced":"0"},{"fixed":"064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"fixed":"e415f818dcdf91626e5e7314b3a4f819ab11f572"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"064567a08f3b9d9b4863fab6060fafe296ac7de9"}]},{"range":[{"fixed":"e415f818dcdf91626e5e7314b3a4f819ab11f572"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["release_3_0_28","release_3_2_10","release_3_2_9","release_3_2_8","release_3_2_7","release_3_2_6","release_3_0_27","release_3_2_5","release_3_2_4","release_3_2_3","release_3_2_2","release_3_2_1","release_3_0_26","release_3_2_0","release_3_0_25","release_3_0_24","release_3_0_23","release_3_0_22","release_3_0_21","release_3_0_20","release_3_0_19","release_3_0_18","release_3_0_17","release_3_0_16","release_3_0_15","release_3_0_14","release_3_0_13","release_3_0_12","release_3_0_11","release_3_0_10","release_3_0_9","release_3_0_8","release_3.0.8","release_3_0_7","release_3_0_6","release_3_0_5","release_3_0_4_rc2","release_3_0_4_rc1","release_3_0_4_rc0","release_3_0_3","release_3_0_2","release_3_0_1","release_3_0_0","release_3_0_0_rc1","branch_4_0_0","release_3_0_0_rc0","release_3_0_0_beta1","release_3_0_0_beta0","release_2_1_7","release_2_1_4","release_2_1_3","release_2_1_2","release_2_1_1","release_2_1_0","release_2_0_5","release_2_0_4","release_2_0_3","release_2_0_2","release_2_0_1","release_2_0_0","release_2_0_0_pre2","release_2_0_0_pre1","release_0_7_0","release_0_6_0","release_0_5_0","release_0_4_0","release_0_3_0","release_0_2_0","release_0_1_0","first-build"],"database_specific":{"vanir_signatures_modified":"2026-11-14T13:28:08Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127029.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572","target":{"file":"src/modules/rlm_eap/libeap/eap_sim.h"},"deprecated":false,"digest":{"line_hashes":["1726525502484441388031761591242071941","278717147510137758079280791321821509257","74467823800595008382237825002146012239","857876496658295392607064629158801709"],"threshold":0.9},"id":"CVE-2026-127029-21ea0d67","signature_type":"Line"},{"id":"CVE-2026-127029-2c2d27f7","signature_type":"Line","signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572","target":{"file":"src/modules/rlm_eap/radeapclient.c"},"deprecated":false,"digest":{"line_hashes":["60114378184392515477369178840938148523","217936494195894394690052732826878948360","276335072233336281702254895535960538327","15160136666192025134623121682146923330","76350574538765490042564397688455244718","108564142635921089057666656842396936450","127622836565491567485508608741836079191","209025056845173412076596190603235003526","291420995886548589327485827415415052119","92289681821171107903569129498444398051","141803252856034689121102525385599926112","285568039659742985635603599904442373494"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572","target":{"file":"src/modules/rlm_eap/libeap/eapcrypto.c"},"deprecated":false,"digest":{"line_hashes":["118003569752522324041782072992098778990","34181819170550077254524777746810006704","121953006978855143946633789610605529306","323925714372724394572648665891825767689","20963864372160509039696790454885394870","178222141829976514906659709302557314629","128621191180726068436772941653937232099","286877934604091020284094367091223491731","70538967121805199760949977083666261690","330949230842324187888712181752393874743","264269047175949781610679785288491663530","237140362087506618549809995251132311583","266576237600854000006732246512830070292","196777573803463564055699519448026687880","272812969202116259442060172183870928231","149227851604158967116400451574667186876","5645172554101335776529443234219197889","42465703871186977984870646004261671762","296100996144666331481364488776059805738","187649618660761460348892809394878838633","312477106598185666972440926027514780945","109703615076872502825677043559118717353","71523375045014727418719610582123556259","54509066377021711816172353132574494310","202577546498430834906333455569682311192","186566609892879603380889827514660947536","301787707984243327349459204981817880339","81472644600335803050232127862485378562","125258281199678426843358082635473078402","164947629909532108244297733386313788289","161272904328192526696524524036325247637","230883635410652530862085904362959441925","36440494990166421550402118974679333395","326177517653773635312255263568547837713","125391321389905440387493788528144925697","291360319562232381207821539736323893121","246672321782137458015444608542823315505","66058248979698824245240909668130508239","118622017497115973263780972555387154797","199315405196870266489262926232623172884","224845481313440869694739146986723168818","150097807866055125350357837570701692615","18532880924459249436220633466058161744","223783697107955641204729762064334843037","319002356066800420896783239511311252284","48977702373398899713470962130043685012","83589862670408942230114900720411835079"],"threshold":0.9},"id":"CVE-2026-127029-30418992"},{"source":"https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572","target":{"file":"src/modules/rlm_eap/radeapclient.c","function":"rc_process_eap_start"},"deprecated":false,"digest":{"function_hash":"57828091355215072393784989173587032132","length":3512},"id":"CVE-2026-127029-461c73ee","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9","target":{"file":"src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c","function":"_session_ticket"},"deprecated":false,"digest":{"length":3095,"function_hash":"103617520085217175967962379845030199428"},"id":"CVE-2026-127029-58633430","signature_type":"Function"},{"digest":{"line_hashes":["232433895769738105356702632332979768344","217785100008388350755420511982395021638","186553568360472091391301735721964856766","121291290883981264244268267305049364106","199064346635144927364108463893258643782","188526437384142204435671189824625027782","335034001548885352647958549539977855858","192187672730279118686781149573756545732","256848121812785689624952341570126382465","256126167023719807151303135019531513800","78266285094466767592327121943901484034","267550860555779239501184374087344917353","300273577328845400171444560392866634320","309521175524646223746510261452171730996","1921542996108616686106422294754563501"],"threshold":0.9},"id":"CVE-2026-127029-678910e3","signature_type":"Line","signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572","target":{"file":"src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c"},"deprecated":false},{"target":{"file":"src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c","function":"eap_sim_sendchallenge"},"deprecated":false,"digest":{"function_hash":"18544328017991395198335555997173211087","length":2029},"id":"CVE-2026-127029-755d423e","signature_type":"Function","signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572"},{"source":"https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572","target":{"file":"src/modules/rlm_eap/libeap/eapcrypto.c","function":"eapsim_calculate_keys"},"deprecated":false,"digest":{"function_hash":"191846531577841741478361001788878734894","length":1582},"id":"CVE-2026-127029-86d1ef6b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c"},"deprecated":false,"digest":{"line_hashes":["154006020761173498528943828790643958913","230571305166576237746810681505336903516","129531406692233188229150107881339192361","41582881654983279109250289288267567425","169549800877391545717416439033476650991","293140772641967787590091872655021224312"],"threshold":0.9},"id":"CVE-2026-127029-cd768510","signature_type":"Line","signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}