CVE-2001-1377: Freeradius

Medium severity, CVSS 5.0. EPSS: 5.4% chance of exploitation in the next 30 days.

Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.

Affected products

• Freeradius Freeradius: version 0.2 only; version 0.3 only
• GNU Radius: version 0.92.1 only; version 0.93 only; version 0.94 only; version 0.95 only
• Icradius Icradius: version 0.14 only; version 0.15 only; version 0.16 only; version 0.17 only; version 0.17b only; version 0.18 only; …
• Livingston Radius: version 2.0 only; version 2.0.1 only; version 2.1 only
• Lucent Radius: version 2.0 only; version 2.0.1 only; version 2.1 only
• Miquel Van Smoorenburg Cistron Radius: version 1.6.1 only; version 1.6.2 only; version 1.6.3 only; version 1.6.4 only; version 1.6.5 only; version 1.6_.0 only
• Openradius Openradius: version 0.8 only; version 0.9 only; version 0.9.1 only; version 0.9.2 only; version 0.9.3 only
• Radiusclient Radiusclient: version 0.3.1 only
• Xtradius Xtradius: version 1.1_pre1 only; version 1.1_pre2 only
• Yard Radius Yard Radius: version 1.0.17 only; version 1.0.18 only; version 1.0.19 only; version 1.0_pre13 only; version 1.0_pre14 only; version 1.0_pre15 only
• Yard Radius Project Yard Radius: version 1.0.16 only

Published 2002-03-04. Last modified 2026-06-16.