Description
Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wpa | 1.0-3 | — |
| Debian 13 | wpa | 1.0-3 | — |
| Debian 12 | wpa | 1.0-3 | — |
| Debian 6.0 | hostapd | 1:0.6.10-2+squeeze1 | DSA-2557-1 |
Advisories 1
- DSA-2557-1 hostapd - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://w1.fi/gitweb/gitweb.cgi?p=hostap.git%3Ba=commitdiff%3Bh=586c446e0ff42ae00315b014924ec669023bd8de
- http://www.pre-cert.de/advisories/PRE-SA-2012-07.txt
- [oss-security] 20121008 [PRE-SA-2012-07] hostapd: Missing EAP-TLS message length validation mailing-list
- 50805 third-party-advisory
- DSA-2557 vendor-advisory
- 1027808 vdb-entry
- MDVSA-2012:168 vendor-advisory
- 86051 vdb-entry
- 55826 vdb-entry
- FreeBSD-SA-12:07 vendor-advisory
- hostapd-eaptls-dos(79104) vdb-entry
- 50888 third-party-advisory