Page MenuHomeVyOS Platform
Create Task
Maniphest T8543

Accel-PPP: parse_framed_route stack buffer overflow via RADIUS Framed-Route in Access-Accept message
Closed, ResolvedPublic
Actions

Description

Unbounded strcpy in parse_framed_route (radius.c:94) copies up to 253 bytes of attacker-supplied RADIUS Framed-Route data (In Access-Accept message) into a 32-byte stack buffer.

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Security vulnerability

Event Timeline

RC created this task.Apr 21 2026, 10:42 PM
RC changed the task status from Open to In progress.
RC triaged this task as High priority.
RC created this object in space S1 VyOS Public.
RC created this object with visibility "Administrators".
RC changed the edit policy from "Custom Policy" to "Maintainers (Project)".Apr 21 2026, 10:42 PM
Viacheslav changed the visibility from "Administrators" to "Public (No Login Required)".Mon, Oct 5, 8:59 AM
pasik subscribed.Mon, Oct 5, 9:07 AM
Viacheslav closed this task as Resolved.Mon, Oct 5, 9:09 AM
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.