Description
Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freeradius | 1.1.6-1 | — |
| Debian 13 | freeradius | 1.1.6-1 | — |
| Debian 12 | freeradius | 1.1.6-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | freeradius +3 | 1.1.3-1.2.el5 | RHSA-2007:0338 |
| RHEL 4 | freeradius +3 | 1.0.1-3.RHEL4.5 | RHSA-2007:0338 |
| RHEL 3 | freeradius | 1.0.1-2.RHEL3.4 | RHSA-2007:0338 |
Advisories 1
- RHSA-2007:0338 Red Hat Security Advisory: freeradius security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 2007-0013 vendor-advisory
- oval:org.mitre.oval:def:11156 vdb-entry signature
- MDKSA-2007:085 vendor-advisory
- GLSA-200704-14 vendor-advisory
- 24996 third-party-advisory
- ADV-2007-1369 vdb-entry
- RHSA-2007:0338 vendor-advisory
- 24849 third-party-advisory
- 23466 vdb-entry
- 24917 third-party-advisory
- http://www.freeradius.org/security.html
- SUSE-SR:2007:010 vendor-advisory
- 25201 third-party-advisory
- 24907 third-party-advisory
- 25220 third-party-advisory
- 1018042 vdb-entry