CVE-2025-24912 Denial of service in hostapd
An attacker positioned between hostapd and the RADIUS server can inject crafted packets to cause authentication failures, resulting in a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24912?
CVE-2025-24912 is a low-severity denial of service vulnerability in Jouni Malinen hostapd, published on 12 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position between the hostapd and the RADIUS server may inject crafted RADIUS packets and force RADIUS authentications to fail.
Weakness: CWE-826
Which versions are affected by CVE-2025-24912?
It affects 1 product.
Linux distribution packages (9)
wpa_supplicant SUSE:Linux Enterprise Micro 5.3 | All versions | 2.9-150000.4.42.1 |
wpa_supplicant SUSE:Linux Enterprise Micro 5.4 | All versions | 2.9-150000.4.42.1 |
wpa_supplicant SUSE:Linux Enterprise Micro 5.5 | All versions | 2.10-150500.3.6.1 |
wpa_supplicant SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 2.10-150600.7.6.1 |
wpa_supplicant SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 2.9-23.23.1 |
wpa_supplicant SUSE:Linux Micro 6.0 | All versions | 2.10-6.1 |
wpa_supplicant openSUSE:Leap 15.6 | All versions | 2.10-150600.7.6.1 |
hostapd openSUSE:Leap 16.0 | All versions | 2.11-bp160.2.1 |
wpa_supplicant openSUSE:Tumbleweed | All versions | 2.11-4.1 |
Products include W1.fi Hostapd.
How do I fix CVE-2025-24912?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-24912 being exploited?
There is no known exploitation of CVE-2025-24912 in the wild and no public exploit code.
Other vulnerabilities in Jouni Malinen hostapd
Sources
Also known as AZL-58604, AZL-58610, CLSA-2026-1786108949, CLSA-2026-1790066310, GHSA-97x4-g54c-4pvm, MGASA-2025-0113 and 10 more.