PatchTheCVECVE-2001-1376: Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to c
50
This week
HIGH 7.5DOWNGRADEDOWNGRADEDOWNGRADE
CVE-2001-1376 is a high-severity flaw (CVSS 7.5) affecting radius, freeradius, radius. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.
Why this priority
- High severity
- EPSS top 5%: very likely to be exploited
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.5 (High) |
| EPSS exploit chance | 8.5% (top 5%) |
| CISA exploited list | No |
| Published | 2002-03-04 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
ascend radius DOWNGRADE
Affected: 1.16
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.16
1. Check installed version
apt-cache policy radius || rpm -q radius || radius --version
2. No fixed release: DOWNGRADE to a release before 1.16 (Debian / Ubuntu)
apt-cache madison radius
sudo apt install radius=<VERSION_BEFORE_1.16>
sudo apt-mark hold radius
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list radius
sudo dnf downgrade radius-<VERSION_BEFORE_1.16>
sudo dnf versionlock add radius
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
freeradius freeradius DOWNGRADE
Affected: 0.2 · 0.3
Fixed in: no fixed release known
Safe to downgrade to: a release before 0.2
1. Check installed version
apt-cache policy freeradius || rpm -q freeradius || freeradius --version
2. No fixed release: DOWNGRADE to a release before 0.2 (Debian / Ubuntu)
apt-cache madison freeradius
sudo apt install freeradius=<VERSION_BEFORE_0.2>
sudo apt-mark hold freeradius
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list freeradius
sudo dnf downgrade freeradius-<VERSION_BEFORE_0.2>
sudo dnf versionlock add freeradius
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
gnu radius DOWNGRADE
Affected: 0.92.1 · 0.93 · 0.94 · 0.95
Fixed in: no fixed release known
Safe to downgrade to: a release before 0.92.1
1. Check installed version
apt-cache policy radius || rpm -q radius || radius --version
2. No fixed release: DOWNGRADE to a release before 0.92.1 (Debian / Ubuntu)
apt-cache madison radius
sudo apt install radius=<VERSION_BEFORE_0.92.1>
sudo apt-mark hold radius
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list radius
sudo dnf downgrade radius-<VERSION_BEFORE_0.92.1>
sudo dnf versionlock add radius
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
icradius icradius DOWNGRADE
Affected: 0.14 · 0.15 · 0.16 · 0.17 · 0.17b · 0.18 · 0.18.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 0.14
1. Check installed version
apt-cache policy icradius || rpm -q icradius || icradius --version
2. No fixed release: DOWNGRADE to a release before 0.14 (Debian / Ubuntu)
apt-cache madison icradius
sudo apt install icradius=<VERSION_BEFORE_0.14>
sudo apt-mark hold icradius
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list icradius
sudo dnf downgrade icradius-<VERSION_BEFORE_0.14>
sudo dnf versionlock add icradius
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
livingston radius DOWNGRADE
Affected: 2.0 · 2.0.1 · 2.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy radius || rpm -q radius || radius --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison radius
sudo apt install radius=<VERSION_BEFORE_2.0>
sudo apt-mark hold radius
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list radius
sudo dnf downgrade radius-<VERSION_BEFORE_2.0>
sudo dnf versionlock add radius
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
lucent radius DOWNGRADE
Affected: 2.0 · 2.0.1 · 2.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy radius || rpm -q radius || radius --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison radius
sudo apt install radius=<VERSION_BEFORE_2.0>
sudo apt-mark hold radius
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list radius
sudo dnf downgrade radius-<VERSION_BEFORE_2.0>
sudo dnf versionlock add radius
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2001-1376?
radius: downgrade or apply the listed mitigation; freeradius: downgrade or apply the listed mitigation; radius: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2001-1376 being exploited?
CVE-2001-1376 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2001-1376 affect?
CVE-2001-1376 affects radius, freeradius, radius. Severity is high (CVSS 7.5). Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.
How urgent is CVE-2001-1376?
Priority 50/100. High severity; EPSS top 5%: very likely to be exploited
Related CVEs
- CVE-2021-35975 MEDIUM 5.3 UPGRADE UPGRADE Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systemat
- CVE-2013-2220 HIGH 7.5 UPGRADE Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows rem
- CVE-2006-4181 HIGH 10.0 DOWNGRADE Format string vulnerability in the sqllog function in the SQL accounting code for radiusd in GNU Radius 1.2 an
- CVE-2004-0849 MEDIUM 5.0 DOWNGRADE Integer overflow in the asn_decode_string() function defined in asn1.c in radiusd for GNU Radius 1.1 and 1.2 b
- CVE-2004-0576 MEDIUM 5.0 DOWNGRADE The radius daemon (radiusd) for GNU Radius 1.1, when compiled with the -enable-snmp option, allows remote atta