Freeradius: stack-based buffer overflow via unbounded eap-sim identity length
Summary
| CVE | CVE-2026-127029 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-12 17:17:42 UTC |
| Updated | 2026-11-12 17:17:43 UTC |
| Description | A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS). |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Problem Types: CWE-787 | CWE-787 Out-of-bounds Write
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 10 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/security/cve/CVE-2026-127029 | [email protected] | access.redhat.com | |
| github.com/FreeRADIUS/freeradius-server/commit/e415f818dcdf91626e5e7314b... | [email protected] | github.com | |
| github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab60... | [email protected] | github.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank s4cr00t (Alipay Security Team) for reporting this issue. Upstream acknowledges Glen Saunders as the original reporter. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-11-03T10:16:22.000Z | Reported to Red Hat. |
| CNA | 2026-11-12T12:10:20.004Z | Made public. |
Workarounds
CNA: Disable the EAP-SIM submodule in the FreeRADIUS configuration if SIM-based authentication is not required: 1. Edit `/etc/raddb/mods-available/eap` (or `/etc/raddb/mods-enabled/eap`) and comment out or remove the `sim` configuration block within the `eap` module definition: ``` # sim { # } ``` 2. Restart the FreeRADIUS service to apply the changes: ``` systemctl restart radiusd ``` Warning: Restarting or reloading the FreeRADIUS service will temporarily interrupt active RADIUS authentication requests. Clients relying on EAP-SIM authentication will no longer be able to authenticate. Additionally, restrict RADIUS UDP traffic (ports 1812 and 1813) to trusted Network Access Server (NAS) IP addresses using firewall rules to limit exposure to untrusted networks.