Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

freeradius/freeradius-server

              master @ 2c22b03
            

271

Fixes

CVEs

CRITICAL

Peak severity

19.4%

Coverage

Highlights

Denial of Service: 94 prior fixes. Scrutinize any change in this area.

src/main/tls.c: most-fixed (18 issues). Treat as high-risk during review.

119 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: Inadequate validation of received scalar and elliptic curve elements in EAP-pwd Commit frames allows full authentication bypass and reflection attacks.

Buffer Overflow: A critical buffer overflow in the packet serialization path appended the shared secret past the allocated data length boundary, which was resolved by migrating to incremental MD5 context updates.

Auth Bypass: Misconfigured active verification stores bypassed TLS certificate revocation validation when TLS checking was enabled but using Pre-Shared Keys (PSK).