Description
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | php-radius | 1.2.5-2.4 | — |
| Debian 7 | php-radius | 1.2.5-2.3+deb7u1 | DSA-2726-1 |
| Debian 6.0 | php-radius | 1.2.5-2+squeeze1 | DSA-2726-1 |
Advisories 1
- DSA-2726-1 php-radius - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026