{"id":"CVE-2026-127030","summary":"Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length","details":"A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).","modified":"2026-11-14T07:04:33.921855729Z","published":"2026-11-12T16:21:52.568Z","database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127030.json"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-127030"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127030.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127030"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572340"},{"type":"FIX","url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"type":"FIX","url":"https://github.com/FreeRADIUS/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freeradius/freeradius-server","events":[{"introduced":"0"},{"fixed":"064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"fixed":"a5d09dad528d7a3a3c4c01158716ab85a12e09ef"}],"database_specific":{"extracted_events":[{"source":"REFERENCES_COMMIT","range":[{"fixed":"064567a08f3b9d9b4863fab6060fafe296ac7de9"}]},{"range":[{"fixed":"a5d09dad528d7a3a3c4c01158716ab85a12e09ef"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["release_3_0_28","release_3_2_10","release_3_2_9","release_3_2_8","release_3_2_7","release_3_2_6","release_3_0_27","release_3_2_5","release_3_2_4","release_3_2_3","release_3_2_2","release_3_2_1","release_3_0_26","release_3_2_0","release_3_0_25","release_3_0_24","release_3_0_23","release_3_0_22","release_3_0_21","release_3_0_20","release_3_0_19","release_3_0_18","release_3_0_17","release_3_0_16","release_3_0_15","release_3_0_14","release_3_0_13","release_3_0_12","release_3_0_11","release_3_0_10","release_3_0_9","release_3_0_8","release_3.0.8","release_3_0_7","release_3_0_6","release_3_0_5","release_3_0_4_rc2","release_3_0_4_rc1","release_3_0_4_rc0","release_3_0_3","release_3_0_2","release_3_0_1","release_3_0_0","release_3_0_0_rc1","branch_4_0_0","release_3_0_0_rc0","release_3_0_0_beta1","release_3_0_0_beta0","release_2_1_7","release_2_1_4","release_2_1_3","release_2_1_2","release_2_1_1","release_2_1_0","release_2_0_5","release_2_0_4","release_2_0_3","release_2_0_2","release_2_0_1","release_2_0_0","release_2_0_0_pre2","release_2_0_0_pre1","release_0_7_0","release_0_6_0","release_0_5_0","release_0_4_0","release_0_3_0","release_0_2_0","release_0_1_0","first-build"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127030.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"251888391511151312361521513246108518808","length":2873},"id":"CVE-2026-127030-286dd902","signature_type":"Function","signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef","target":{"function":"eap_fast_process","file":"src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9","target":{"file":"src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c","function":"_session_ticket"},"deprecated":false,"digest":{"function_hash":"103617520085217175967962379845030199428","length":3095},"id":"CVE-2026-127030-58633430"},{"signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef","target":{"file":"src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c"},"deprecated":false,"digest":{"line_hashes":["277581210017377343152665626922163466080","190679290598448098165222392600456703731","56309174078894680058608017271906117845","27871552578386582531666381682447459825","304382010828980735661606202391395505255","279031616470901171671274235561336959266","224745998338524280678383853637284633480","737077999224593280265165863490427683","152841737500494053887130929920624965837","262517292548773907459248522539282881537","35823235433050589666372009317570566663","196333513176398922679961040114069822475","257029615386284968225655268140777992165","214787453201525554009636647264265997554","7442924243671242907591066726735759175","167367567618288291583754719836877546158","229962632038381590974081050973088728959","248416421779281957253577640342135551277","338748648981569142682200169977184978534","211671956428152943287982777745937173845","65238242082819326209754231812760873548","335604645705861042249948391036151564677","318223121483148078348617405652721545595","81338251867462147641167037415928992223","168804475269396657336851365725291489311","206078950315664257330820105554606764864","159524999924286124856043260543788677820","152585786007837503079838428638342572302","219295624469341826925965643726404348827","291765018258546416790251838246400910963","233120069794420700303823214227425500943","83538832752277210286553586049026352358","313382789333686739605098816978332446117","72802762298654941006071231857584925615","207952317501909262220957673568760555666","183289090556036665074475532926332137091","153515902047375199771562969902008419338","178654139779577259843637103833059995951","117384973145734480293992897010630861615","148009880693570937275008936243083865685","257408779842147243379867650248985724401","191906930194242693892229243884073062037","26812944970881798502797194619136884759","283823083117267245522362451358671841951","209588800703648571643914145296545487417","80018362282287823005349914435774177721","136893809792414641228447839502165857759","184437416998097387840571402897678219850","247833826718842951104861710277975933382","154102737783055847760867396364733850145","155716508131045909992614739382394583508","160920792844797056338152790224040380505","149026070717040115362796066614949489677","307470638548185350582119839982646656432","40454683979205466076038783614515415755","55020447001157362736693201475150277552","83908645261508944810559521996057070451","228601453354256516957155757677523617087","263188353654177998286398621496897437249","181720361507338477633636119871154168579","336005695082702317628054048713387473941","330728885672592832936718700066860632771","149607413329378674978048979987943521624","177219949929335305309755289549379848511","179360672954031152893942923985559675519","317516079623525227999584749031775539121","143004192472406780994063058514074832773","339961958782940647442468801893335475416","228208320210308106950208367183695496245","198678711762748028254756397962501599061","248205243361784054142402697911909572469","5394657145547523733478435848818402303","50917175110983456405148175076439346945","257029615386284968225655268140777992165","337288438845237816131366054477875743087","154841605756385943035106777775710258020","312905491377768326188803817787328723582","324870575803694906616282571187573233044","85381592216564391328478310027126015088","265229095234446734886939243847326826216","234400909672502237597313431863740833097","277855706349756355176233242548070680020","153648022246072322474283466601228229649","325698064374143789799724027077965930858","6162319071342545818175076430215203766","256692073630329681491149114607762494760","6457090150052676218306056825858313369","145745922329469986722020757700938900952","94678808104647992675382323459949965444","10640140104725748801343631980819293475","120577793529268177558671887693034715770","182362593580884316527279550965970592940","111890013628510233175298282688411669847","38728901732678816057867534038126430525","276482623644973366853309568304257876000","175389664368540816965976285003762259724","109556346808848125473797304197690965622","180068726560420329767122106441267715923","20484973427030693477734995742911210090","163386371434233273985232157684122572476","69688904162331053819540939926789851233"],"threshold":0.9},"id":"CVE-2026-127030-654365ea","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"80468792638011567768266434052074014383","length":2534},"id":"CVE-2026-127030-6bf30d9b","signature_type":"Function","signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef","target":{"file":"src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c","function":"eap_fast_decode_vp"}},{"target":{"file":"src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c","function":"eap_fast_fast2vp"},"deprecated":false,"digest":{"function_hash":"258441118179369655356428765935233480880","length":1280},"id":"CVE-2026-127030-9e129754","signature_type":"Function","signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef"},{"signature_version":"v1","source":"https://github.com/freeradius/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9","target":{"file":"src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["154006020761173498528943828790643958913","230571305166576237746810681505336903516","129531406692233188229150107881339192361","41582881654983279109250289288267567425","169549800877391545717416439033476650991","293140772641967787590091872655021224312"]},"id":"CVE-2026-127030-cd768510","signature_type":"Line"}],"vanir_signatures_modified":"2026-11-14T07:04:33Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}