Read the docs
TI-2022-20210 Aliases CVE-2022-41861GHSA-3886-rc87-ccgx

Uncontrolled resource consumption in freeradius

Priority LOW 31CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01143 66th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—freeradiusAll versions from 0.0.1 to 3.0.25—No fix listedCNA
  • freeradius Vendor— Affected All versions from 0.0.1 to 3.0.25 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*up to 3.0.25Vulnerablefreeradius
  • cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:* Versions up to 3.0.25 Vulnerable ·freeradius

Remediation

Red Hat 2 advisories

  • RHSA-2023:2870 Released 2023-05-16 · Red Hat rating Moderate
    freeradius:3.0 security update
    • Red Hat Enterprise Linux AppStream (v. 8) freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.aarch64::freeradius:3.0, freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.ppc64le::freeradius:3.0, freeradius-3.0.20-14.module+el8.8.0+17558+3f8a93b9.s390x::freeradius:3.0 +47
  • RHSA-2023:2166 Released 2023-05-09 · Red Hat rating Moderate
    freeradius security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) freeradius-3.0.21-37.el9, freeradius-devel-3.0.21-37.el9, freeradius-doc-3.0.21-37.el9 +4
    • Red Hat Enterprise Linux CRB (v. 9) freeradius-mysql-3.0.21-37.el9, freeradius-perl-3.0.21-37.el9, freeradius-postgresql-3.0.21-37.el9 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2023:2870
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2023:2166
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2023:2166

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-41861
  2. 2026-10-03 Alias added: GHSA-3886-rc87-ccgx

References

Patch 2

  • TI-2019-07466 Race condition in freeradius CVSS 3.1HIGH 7.0
  • TI-2024-03351 RADIUS Protocol under RFC2865 is vulnerable to forgery attacks. CVSS 3.1CRITICAL 9.0
  • TI-2019-08409 FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing… CVSS 3.0CRITICAL 9.8
  • TI-2017-08061 An FR-GV-202 issue in FreeRADIUS 2.x before 2.2.10 allows "Write overflow in… CVSS 3.0CRITICAL 9.8
  • TI-2017-08066 An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write overflow in… CVSS 3.0CRITICAL 9.8
  • TI-2017-06599 The TLS session cache in FreeRADIUS 2.1.1 through 2.1.7, 3.0.x before 3.0.14, 3.1.x… CVSS 3.0CRITICAL 9.8
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences