{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"freeradius","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"freeradius","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"freeradius","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"freeradius:3.0/freeradius","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"freeradius","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-127030","cwes":["CWE-787"],"description":"A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794503863283,"publishedAt":1794500512568,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-127030"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572340"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/FreeRADIUS/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-127030"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2572340"},{"source":"secalert@redhat.com","tags":[],"url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9"},{"source":"secalert@redhat.com","tags":[],"url":"https://github.com/FreeRADIUS/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Disable the EAP-FAST submodule in the FreeRADIUS configuration, or restrict incoming RADIUS traffic to trusted network access points.\n\n1. Disable EAP-FAST:\nIn `/etc/raddb/mods-available/eap` (or `/etc/raddb/eap.conf`), comment out the `fast` section within the `eap` configuration block and verify that `default_eap_type` is not set to `fast`.\n\n2. Apply configuration changes:\n```\nsystemctl restart radiusd\n```\n\n3. Limit network exposure:\nRestrict UDP port 1812 to authorized Network Access Server (NAS) clients using firewalld:\n```\nfirewall-cmd --permanent --zone=internal --add-source=<TRUSTED_IP_OR_SUBNET>\nfirewall-cmd --permanent --zone=internal --add-port=1812/udp\nfirewall-cmd --reload\n```\n\nCaveats:\nDisabling EAP-FAST prevents authentication for any network clients that rely exclusively on EAP-FAST. Restricting firewall rules will block traffic from unlisted authenticator sources.\n\nWarning:\nRestarting or reloading the radiusd service will temporarily disrupt active RADIUS authentication processing."}],"revision":"b6a673adebdb72cfbe3da85b3df2e29d7b120eacfd9598358f639a2425df3954","sources":[{"modifiedAt":1794500512568,"name":"CNA: redhat","retrievedAt":1794503445517,"url":"https://www.cve.org/CVERecord?id=CVE-2026-127030"},{"modifiedAt":1794503863283,"name":"NVD","retrievedAt":1794507524680,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127030"}],"ssvc":null,"status":"published","title":"Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length","updatedAt":1794507524680}