CVE-2022-41861 Denial of service in freeradius

Medium 6.5 Published 17 Jan 2023 Updated 3 Nov 2025

A malicious RADIUS client or home server can crash the FreeRADIUS server by sending a malformed binary attribute.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-41861?

CVE-2022-41861 is a medium-severity denial of service vulnerability in freeradius, published on 17 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash.

Weakness: CWE-20, CWE-400

Which versions are affected by CVE-2022-41861?

It affects 1 product.

Products include Freeradius Freeradius.

How do I fix CVE-2022-41861?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-41861 being exploited?

There is no known exploitation of CVE-2022-41861 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2022-41861, AZL-13063, DEBIAN-CVE-2022-41861, GHSA-3886-rc87-ccgx, UBUNTU-CVE-2022-41861.