CVE-2012-4445: w1.fi Hostapd

Medium severity, CVSS 4.3. EPSS: 4.2% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set.

Affected products

• w1.fi Hostapd: version 0.6.0 only; version 0.6.1 only; version 0.6.2 only; version 0.6.3 only; version 0.6.4 only; version 0.6.5 only; …

Published 2012-10-10. Last modified 2026-06-16.