https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-3596.htmlhttps://patchthecve.com/cve/CVE-2024-3596.htmlThu, 15 Oct 2026 01:18:35 +0000CRITICAL 9.0: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.https://patchthecve.com/cve/CVE-2022-41861.htmlhttps://patchthecve.com/cve/CVE-2022-41861.htmlWed, 17 Jun 2026 05:03:56 +0000MEDIUM 6.5: A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.https://patchthecve.com/cve/CVE-2022-41860.htmlhttps://patchthecve.com/cve/CVE-2022-41860.htmlWed, 17 Jun 2026 05:03:56 +0000HIGH 7.5: In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup will fail, but the SIM code will not check for that failure. Instead, it will dereference a NULL pointer, and cause the server to crash.https://patchthecve.com/cve/CVE-2022-41859.htmlhttps://patchthecve.com/cve/CVE-2022-41859.htmlWed, 17 Jun 2026 05:03:56 +0000HIGH 7.5: In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size of an offline dictionary attack.https://patchthecve.com/cve/CVE-2019-17185.htmlhttps://patchthecve.com/cve/CVE-2019-17185.htmlWed, 17 Jun 2026 02:23:25 +0000HIGH 7.5: In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Dhttps://patchthecve.com/cve/CVE-2015-9542.htmlhttps://patchthecve.com/cve/CVE-2015-9542.htmlWed, 17 Jun 2026 00:36:44 +0000HIGH 7.5: add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy(). An attacker could send a crafted password to an application (loading the pam_radius library) and crash it. Arbitrary cohttps://patchthecve.com/cve/CVE-2019-13456.htmlhttps://patchthecve.com/cve/CVE-2019-13456.htmlWed, 17 Jun 2026 02:16:47 +0000MEDIUM 6.5: In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cannot be found within 10 iterations of the hunting and pecking loop. This leaks information that an attacker can use to recover the password of any user. This information leakage is sihttps://patchthecve.com/cve/CVE-2019-10143.htmlhttps://patchthecve.com/cve/CVE-2019-10143.htmlWed, 17 Jun 2026 02:10:20 +0000HIGH 7.0: It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inacceshttps://patchthecve.com/cve/CVE-2019-11235.htmlhttps://patchthecve.com/cve/CVE-2019-11235.htmlWed, 17 Jun 2026 02:12:35 +0000CRITICAL 9.8: FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.https://patchthecve.com/cve/CVE-2019-11234.htmlhttps://patchthecve.com/cve/CVE-2019-11234.htmlWed, 17 Jun 2026 02:12:35 +0000CRITICAL 9.8: FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497.https://patchthecve.com/cve/CVE-2017-10987.htmlhttps://patchthecve.com/cve/CVE-2017-10987.htmlWed, 17 Jun 2026 01:01:02 +0000HIGH 7.5: An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Buffer over-read in fr_dhcp_decode_suboptions()" and a denial of service.https://patchthecve.com/cve/CVE-2017-10986.htmlhttps://patchthecve.com/cve/CVE-2017-10986.htmlWed, 17 Jun 2026 01:01:02 +0000HIGH 7.5: An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - Infinite read in dhcp_attr2vp()" and a denial of service.https://patchthecve.com/cve/CVE-2017-10985.htmlhttps://patchthecve.com/cve/CVE-2017-10985.htmlWed, 17 Jun 2026 01:01:02 +0000HIGH 7.5: An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite loop and memory exhaustion with 'concat' attributes" and a denial of service.https://patchthecve.com/cve/CVE-2017-10984.htmlhttps://patchthecve.com/cve/CVE-2017-10984.htmlWed, 17 Jun 2026 01:01:02 +0000CRITICAL 9.8: An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in data2vp_wimax()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.https://patchthecve.com/cve/CVE-2017-10983.htmlhttps://patchthecve.com/cve/CVE-2017-10983.htmlWed, 17 Jun 2026 01:01:02 +0000HIGH 7.5: An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "DHCP - Read overflow when decoding option 63" and a denial of service.https://patchthecve.com/cve/CVE-2017-10982.htmlhttps://patchthecve.com/cve/CVE-2017-10982.htmlWed, 17 Jun 2026 01:01:02 +0000HIGH 7.5: An FR-GV-205 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Buffer over-read in fr_dhcp_decode_options()" and a denial of service.https://patchthecve.com/cve/CVE-2017-10981.htmlhttps://patchthecve.com/cve/CVE-2017-10981.htmlWed, 17 Jun 2026 01:01:02 +0000HIGH 7.5: An FR-GV-204 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in fr_dhcp_decode()" and a denial of service.https://patchthecve.com/cve/CVE-2017-10980.htmlhttps://patchthecve.com/cve/CVE-2017-10980.htmlWed, 17 Jun 2026 01:01:02 +0000HIGH 7.5: An FR-GV-203 issue in FreeRADIUS 2.x before 2.2.10 allows "DHCP - Memory leak in decode_tlv()" and a denial of service.https://patchthecve.com/cve/CVE-2017-10979.htmlhttps://patchthecve.com/cve/CVE-2017-10979.htmlWed, 17 Jun 2026 01:01:01 +0000CRITICAL 9.8: An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in rad_coalesce()" - this allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code.https://patchthecve.com/cve/CVE-2017-10978.htmlhttps://patchthecve.com/cve/CVE-2017-10978.htmlWed, 17 Jun 2026 01:01:01 +0000HIGH 7.5: An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service.https://patchthecve.com/cve/CVE-2017-9148.htmlhttps://patchthecve.com/cve/CVE-2017-9148.htmlWed, 17 Jun 2026 01:27:33 +0000CRITICAL 9.8: The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 fails to reliably prevent resumption of an unauthenticated session, which allows remote attackers (such as malicious 802.1X supplicants) to bypass authentication via PEAhttps://patchthecve.com/cve/CVE-2015-4680.htmlhttps://patchthecve.com/cve/CVE-2015-4680.htmlWed, 17 Jun 2026 00:27:43 +0000HIGH 7.5: FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.https://patchthecve.com/cve/CVE-2015-8764.htmlhttps://patchthecve.com/cve/CVE-2015-8764.htmlWed, 17 Jun 2026 00:35:11 +0000HIGH 8.1: Off-by-one error in the EAP-PWD module in FreeRADIUS 3.0 through 3.0.8, which triggers a buffer overflow.https://patchthecve.com/cve/CVE-2015-8763.htmlhttps://patchthecve.com/cve/CVE-2015-8763.htmlWed, 17 Jun 2026 00:35:11 +0000HIGH 8.1: The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to have unspecified impact via a crafted (1) commit or (2) confirm message, which triggers an out-of-bounds read.https://patchthecve.com/cve/CVE-2015-8762.htmlhttps://patchthecve.com/cve/CVE-2015-8762.htmlWed, 17 Jun 2026 00:35:11 +0000MEDIUM 5.9: The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a zero-length EAP-PWD packet.https://patchthecve.com/cve/CVE-2014-2015.htmlhttps://patchthecve.com/cve/CVE-2014-2015.htmlWed, 17 Jun 2026 00:05:55 +0000HIGH 7.5: Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long passwordhttps://patchthecve.com/cve/CVE-2011-4966.htmlhttps://patchthecve.com/cve/CVE-2011-4966.htmlTue, 16 Jun 2026 23:35:44 +0000MEDIUM 6.0: modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.https://patchthecve.com/cve/CVE-2012-3547.htmlhttps://patchthecve.com/cve/CVE-2012-3547.htmlTue, 16 Jun 2026 23:43:26 +0000MEDIUM 6.8: Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.https://patchthecve.com/cve/CVE-2011-2701.htmlhttps://patchthecve.com/cve/CVE-2011-2701.htmlTue, 16 Jun 2026 23:31:49 +0000MEDIUM 5.8: The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.https://patchthecve.com/cve/CVE-2010-3697.htmlhttps://patchthecve.com/cve/CVE-2010-3697.htmlTue, 16 Jun 2026 23:23:21 +0000MEDIUM 4.3: The wait_for_child_to_die function in main/event.c in FreeRADIUS 2.1.x before 2.1.10, in certain circumstances involving long-term database outages, does not properly handle long queue times for requests, which allows remote attackers to cause a denial of service (daemon crash) by sending many requehttps://patchthecve.com/cve/CVE-2010-3696.htmlhttps://patchthecve.com/cve/CVE-2010-3696.htmlTue, 16 Jun 2026 23:23:21 +0000MEDIUM 4.3: The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9, in certain non-default builds, does not properly handle the DHCP Relay Agent Information option, which allows remote attackers to cause a denial of service (infinite loop and daemon outage) via a packet that has more than one sub-option.https://patchthecve.com/cve/CVE-2009-3111.htmlhttps://patchthecve.com/cve/CVE-2009-3111.htmlTue, 16 Jun 2026 23:10:58 +0000MEDIUM 5.0: The rad_decode function in FreeRADIUS before 1.1.8 allows remote attackers to cause a denial of service (radiusd crash) via zero-length Tunnel-Password attributes, as demonstrated by a certain module in VulnDisco Pack Professional 7.6 through 8.11. NOTE: this is a regression error related to CVE-20https://patchthecve.com/cve/CVE-2008-4474.htmlhttps://patchthecve.com/cve/CVE-2008-4474.htmlTue, 16 Jun 2026 22:57:52 +0000HIGH 7.2: freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct.https://patchthecve.com/cve/CVE-2007-2028.htmlhttps://patchthecve.com/cve/CVE-2007-2028.htmlTue, 16 Jun 2026 22:38:46 +0000MEDIUM 5.0: Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR dhttps://patchthecve.com/cve/CVE-2007-0080.htmlhttps://patchthecve.com/cve/CVE-2007-0080.htmlTue, 16 Jun 2026 22:34:52 +0000MEDIUM 6.6: Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance. NOTE: the impact of this issue has been disputed by a reliable third party and the vendor, who states thhttps://patchthecve.com/cve/CVE-2006-1354.htmlhttps://patchthecve.com/cve/CVE-2006-1354.htmlTue, 16 Jun 2026 22:22:29 +0000HIGH 7.5: Unspecified vulnerability in FreeRADIUS 1.0.0 up to 1.1.0 allows remote attackers to bypass authentication or cause a denial of service (server crash) via "Insufficient input validation" in the EAP-MSCHAPv2 state machine module.https://patchthecve.com/cve/CVE-2005-4746.htmlhttps://patchthecve.com/cve/CVE-2005-4746.htmlTue, 16 Jun 2026 22:19:21 +0000HIGH 7.8: Multiple buffer overflows in FreeRADIUS 1.0.3 and 1.0.4 allow remote attackers to cause denial of service (crash) via (1) the rlm_sqlcounter module or (2) unknown vectors "while expanding %t".https://patchthecve.com/cve/CVE-2005-4745.htmlhttps://patchthecve.com/cve/CVE-2005-4745.htmlTue, 16 Jun 2026 22:19:21 +0000HIGH 7.5: SQL injection vulnerability in the rlm_sqlcounter module in FreeRADIUS 1.0.3 and 1.0.4 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.https://patchthecve.com/cve/CVE-2005-4744.htmlhttps://patchthecve.com/cve/CVE-2005-4744.htmlTue, 16 Jun 2026 22:19:20 +0000MEDIUM 6.4: Off-by-one error in the sql_error function in sql_unixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by causing the external database query to fail. NOTE: this single https://patchthecve.com/cve/CVE-2005-1455.htmlhttps://patchthecve.com/cve/CVE-2005-1455.htmlTue, 16 Jun 2026 22:13:04 +0000HIGH 7.5: Buffer overflow in the sql_escape_func function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote attackers to cause a denial of service (crash).https://patchthecve.com/cve/CVE-2005-1454.htmlhttps://patchthecve.com/cve/CVE-2005-1454.htmlTue, 16 Jun 2026 22:13:04 +0000HIGH 7.5: SQL injection vulnerability in the radius_xlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via (1) group_membership_query, (2) simul_count_query, or (3) simul_verify_query configuration entries.https://patchthecve.com/cve/CVE-2004-0961.htmlhttps://patchthecve.com/cve/CVE-2004-0961.htmlTue, 16 Jun 2026 22:06:44 +0000MEDIUM 5.0: Memory leak in FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (memory exhaustion) via a series of Access-Request packets with (1) Ascend-Send-Secret, (2) Ascend-Recv-Secret, or (3) Tunnel-Password attributes.https://patchthecve.com/cve/CVE-2004-0960.htmlhttps://patchthecve.com/cve/CVE-2004-0960.htmlTue, 16 Jun 2026 22:06:44 +0000MEDIUM 5.0: FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (core dump) via malformed USR vendor-specific attributes (VSA) that cause a memcpy operation with a -1 argument.https://patchthecve.com/cve/CVE-2004-0938.htmlhttps://patchthecve.com/cve/CVE-2004-0938.htmlTue, 16 Jun 2026 22:06:42 +0000MEDIUM 5.0: FreeRADIUS before 1.0.1 allows remote attackers to cause a denial of service (server crash) by sending an Ascend-Send-Secret attribute without the required leading packet.https://patchthecve.com/cve/CVE-2003-0967.htmlhttps://patchthecve.com/cve/CVE-2003-0967.htmlTue, 16 Jun 2026 22:03:15 +0000MEDIUM 5.0: rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via a short RADIUS string attribute with a tag, which causes memcpy to be called with a -1 length argument, as demonstrated using the Tunnel-Password attribute.https://patchthecve.com/cve/CVE-2002-0318.htmlhttps://patchthecve.com/cve/CVE-2002-0318.htmlTue, 16 Jun 2026 21:57:12 +0000MEDIUM 5.0: FreeRADIUS RADIUS server allows remote attackers to cause a denial of service (CPU consumption) via a flood of Access-Request packets.https://patchthecve.com/cve/CVE-2001-1377.htmlhttps://patchthecve.com/cve/CVE-2001-1377.htmlTue, 16 Jun 2026 21:56:09 +0000MEDIUM 5.0: Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.https://patchthecve.com/cve/CVE-2001-1376.htmlhttps://patchthecve.com/cve/CVE-2001-1376.htmlTue, 16 Jun 2026 21:56:08 +0000HIGH 7.5: Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.