CVE-2003-0967: rad_decode in FreeRADIUS 0.9.2 and earlier allows remote attackers to cause a denial of service (crash) via...

Security readout for executives and security teams

CVE-2003-0967 is a remote crash issue in FreeRADIUS 0.9.2 and earlier. A malformed short tagged RADIUS string attribute, described using Tunnel-Password, can make the server fail. The business impact is authentication service disruption, not confirmed data theft or code execution from the provided sources. Exposure is most likely where FreeRADIUS 0.9.2 or earlier is still deployed, especially if RADIUS traffic can reach the service from untrusted clients or networks. Modern vendor-managed systems are less likely affected, but legacy appliances and old Linux packages should be checked. Schedule remediation for any affected legacy RADIUS servers because authentication outages can disrupt VPN, Wi-Fi, and network access. This is not marked as actively exploited in the provided sources, so prioritize based on exposure and operational dependency. Mitigation focus: Inventory systems running FreeRADIUS or bundled RADIUS services.; Check vendor guidance and apply the relevant FreeRADIUS security update.; For Red Hat systems, review RHSA-2003:386 applicability..

Prepared

Jun 30, 2026, 07:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.