← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-w6v4-9j58-rv79: Heap Out-of-Bounds Read on Nested TLV Decoding in eap_fast_decode_pair & Crypto-Binding Verification Bypass in eap_fast_process_tlvs (FreeRADIUS/freeradius-server)

[PATCHED UPSTREAM ON MASTER BY @alandekok (COMMITS 1ef1b499f1 & 1c7661e1bd)]
Privately reported to FreeRADIUS/freeradius-server via GitHub Private Vulnerability Reporting (GHSA-w6v4-9j58-rv79) covering eap_fast_decode_pair() and eap_fast_process_tlvs() in src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c (introduced on master in commit 8ec5e2482d).
Confirmed and patched upstream on master by FreeRADIUS lead developer Alan DeKok (@alandekok) in commits 1ef1b499f1 ("fix issues introduced in commit 8ec5e2482d — Reported by Serhii Shunko") and 1c7661e1bd ("skip len bytes, and not bytes from partially decoded content") on 2026-10-28.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-w6v4-9j58-rv79",
  "repository": "FreeRADIUS/freeradius-server",
  "html_url": "https://github.com/FreeRADIUS/freeradius-server/security/advisories/GHSA-w6v4-9j58-rv79",
  "fix_commits": [
    "https://github.com/FreeRADIUS/freeradius-server/commit/1ef1b499f1",
    "https://github.com/FreeRADIUS/freeradius-server/commit/1c7661e1bd"
  ],
  "state": "closed (patched on master; never appeared in an official release)",
  "updated_at": "2026-10-29T00:30:33Z",
  "summary": "Heap Out-of-Bounds Read on Nested TLV Decoding in eap_fast_decode_pair and Crypto-Binding Verification Bypass in eap_fast_process_tlvs",
  "affected_file": "src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c",
  "severity": "critical",
  "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "status": "Patched Upstream on master (commits 1ef1b499f1 & 1c7661e1bd)",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-125",
    "CWE-345"
  ]
}