CVE-2026-127030: Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).
Other sources
A flaw was found in freeradius's EAP-FAST module. The SessionTicket callback invoked during the TLS ClientHello phase of the EAP-FAST handshake validates the PAC-Opaque length using mismatched integer types, allowing an attacker-supplied value to underflow and bypass the check. The callback then decrypts attacker-controlled ciphertext into a fixed-size buffer before the authentication tag is verified, so a crafted ClientHello can write data past the end of a stack buffer. A remote, unauthenticated client speaking EAP-FAST to a server with the module enabled can trigger this to crash the RADIUS server process before any credential exchange.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Servers with the EAP-FAST module enabled are exposed. The vulnerable processing occurs during the TLS ClientHello phase of an EAP-FAST handshake.
Does exploitation require credentials or prior access?
No. A remote, unauthenticated client that can speak EAP-FAST to the server can send a specially crafted handshake request, before any credential exchange occurs.
How can I determine whether my server may be affected?
Check whether the server has the EAP-FAST module enabled and accepts EAP-FAST handshakes. An affected server can be crashed by the malformed handshake during session-ticket processing.