CVE-2026-127029

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-127029
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127029.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-127029
Downstream
Published
2026-11-12T16:21:48Z
Modified
2026-11-14T13:28:08Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Freeradius: stack-based buffer overflow via unbounded eap-sim identity length
Details

A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/127xxx/CVE-2026-127029.json"
}
References

Affected packages

Git / github.com/freeradius/freeradius-server

Affected ranges

Type
GIT
Repo
https://github.com/freeradius/freeradius-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
064567a08f3b9d9b4863fab6060fafe296ac7de9
Fixed
e415f818dcdf91626e5e7314b3a4f819ab11f572
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "064567a08f3b9d9b4863fab6060fafe296ac7de9"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "e415f818dcdf91626e5e7314b3a4f819ab11f572"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
branch_4_0_0
first-build
release_0_1_0
release_0_2_0
release_0_3_0
release_0_4_0
release_0_5_0
release_0_6_0
release_0_7_0
release_2_0_0
release_2_0_0_pre1
release_2_0_0_pre2
release_2_0_1
release_2_0_2
release_2_0_3
release_2_0_4
release_2_0_5
release_2_1_0
release_2_1_1
release_2_1_2
release_2_1_3
release_2_1_4
release_2_1_7
release_3_0_0
release_3_0_0_beta0
release_3_0_0_beta1
release_3_0_0_rc0
release_3_0_0_rc1
release_3_0_1
release_3_0_10
release_3_0_11
release_3_0_12
release_3_0_13
release_3_0_14
release_3_0_15
release_3_0_16
release_3_0_17
release_3_0_18
release_3_0_19
release_3_0_2
release_3_0_20
release_3_0_21
release_3_0_22
release_3_0_23
release_3_0_24
release_3_0_25
release_3_0_26
release_3_0_27
release_3_0_28
release_3_0_3
release_3_0_4_rc0
release_3_0_4_rc1
release_3_0_4_rc2
release_3_0_5
release_3_0_6
release_3_0_7
release_3_0_8
release_3_0_9
release_3_2_0
release_3_2_1
release_3_2_10
release_3_2_2
release_3_2_3
release_3_2_4
release_3_2_5
release_3_2_6
release_3_2_7
release_3_2_8
release_3_2_9
release_3.*
release_3.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-127029.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "1726525502484441388031761591242071941",
                "278717147510137758079280791321821509257",
                "74467823800595008382237825002146012239",
                "857876496658295392607064629158801709"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-127029-21ea0d67",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572",
        "target": {
            "file": "src/modules/rlm_eap/libeap/eap_sim.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "60114378184392515477369178840938148523",
                "217936494195894394690052732826878948360",
                "276335072233336281702254895535960538327",
                "15160136666192025134623121682146923330",
                "76350574538765490042564397688455244718",
                "108564142635921089057666656842396936450",
                "127622836565491567485508608741836079191",
                "209025056845173412076596190603235003526",
                "291420995886548589327485827415415052119",
                "92289681821171107903569129498444398051",
                "141803252856034689121102525385599926112",
                "285568039659742985635603599904442373494"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-127029-2c2d27f7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572",
        "target": {
            "file": "src/modules/rlm_eap/radeapclient.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "118003569752522324041782072992098778990",
                "34181819170550077254524777746810006704",
                "121953006978855143946633789610605529306",
                "323925714372724394572648665891825767689",
                "20963864372160509039696790454885394870",
                "178222141829976514906659709302557314629",
                "128621191180726068436772941653937232099",
                "286877934604091020284094367091223491731",
                "70538967121805199760949977083666261690",
                "330949230842324187888712181752393874743",
                "264269047175949781610679785288491663530",
                "237140362087506618549809995251132311583",
                "266576237600854000006732246512830070292",
                "196777573803463564055699519448026687880",
                "272812969202116259442060172183870928231",
                "149227851604158967116400451574667186876",
                "5645172554101335776529443234219197889",
                "42465703871186977984870646004261671762",
                "296100996144666331481364488776059805738",
                "187649618660761460348892809394878838633",
                "312477106598185666972440926027514780945",
                "109703615076872502825677043559118717353",
                "71523375045014727418719610582123556259",
                "54509066377021711816172353132574494310",
                "202577546498430834906333455569682311192",
                "186566609892879603380889827514660947536",
                "301787707984243327349459204981817880339",
                "81472644600335803050232127862485378562",
                "125258281199678426843358082635473078402",
                "164947629909532108244297733386313788289",
                "161272904328192526696524524036325247637",
                "230883635410652530862085904362959441925",
                "36440494990166421550402118974679333395",
                "326177517653773635312255263568547837713",
                "125391321389905440387493788528144925697",
                "291360319562232381207821539736323893121",
                "246672321782137458015444608542823315505",
                "66058248979698824245240909668130508239",
                "118622017497115973263780972555387154797",
                "199315405196870266489262926232623172884",
                "224845481313440869694739146986723168818",
                "150097807866055125350357837570701692615",
                "18532880924459249436220633466058161744",
                "223783697107955641204729762064334843037",
                "319002356066800420896783239511311252284",
                "48977702373398899713470962130043685012",
                "83589862670408942230114900720411835079"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-127029-30418992",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572",
        "target": {
            "file": "src/modules/rlm_eap/libeap/eapcrypto.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "57828091355215072393784989173587032132",
            "length": 3512
        },
        "id": "CVE-2026-127029-461c73ee",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572",
        "target": {
            "file": "src/modules/rlm_eap/radeapclient.c",
            "function": "rc_process_eap_start"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "103617520085217175967962379845030199428",
            "length": 3095
        },
        "id": "CVE-2026-127029-58633430",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freeradius/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9",
        "target": {
            "file": "src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c",
            "function": "_session_ticket"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "232433895769738105356702632332979768344",
                "217785100008388350755420511982395021638",
                "186553568360472091391301735721964856766",
                "121291290883981264244268267305049364106",
                "199064346635144927364108463893258643782",
                "188526437384142204435671189824625027782",
                "335034001548885352647958549539977855858",
                "192187672730279118686781149573756545732",
                "256848121812785689624952341570126382465",
                "256126167023719807151303135019531513800",
                "78266285094466767592327121943901484034",
                "267550860555779239501184374087344917353",
                "300273577328845400171444560392866634320",
                "309521175524646223746510261452171730996",
                "1921542996108616686106422294754563501"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-127029-678910e3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572",
        "target": {
            "file": "src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "18544328017991395198335555997173211087",
            "length": 2029
        },
        "id": "CVE-2026-127029-755d423e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572",
        "target": {
            "file": "src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c",
            "function": "eap_sim_sendchallenge"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "191846531577841741478361001788878734894",
            "length": 1582
        },
        "id": "CVE-2026-127029-86d1ef6b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/freeradius/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572",
        "target": {
            "file": "src/modules/rlm_eap/libeap/eapcrypto.c",
            "function": "eapsim_calculate_keys"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "154006020761173498528943828790643958913",
                "230571305166576237746810681505336903516",
                "129531406692233188229150107881339192361",
                "41582881654983279109250289288267567425",
                "169549800877391545717416439033476650991",
                "293140772641967787590091872655021224312"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-127029-cd768510",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/freeradius/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9",
        "target": {
            "file": "src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c"
        }
    }
]
vanir_signatures_modified 
"2026-11-14T13:28:08Z"