CVE-2010-3697

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-10-07 · updated 2026-06-16
Weakness: CWE-399

Description

The wait_for_child_to_die function in main/event.c in FreeRADIUS 2.1.x before 2.1.10, in certain circumstances involving long-term database outages, does not properly handle long queue times for requests, which allows remote attackers to cause a denial of service (daemon crash) by sending many requests.

Affected products

freeradius: 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.6 (+3)

References

http://freeradius.org/press/index.html#2.1.10
http://github.com/alandekok/freeradius-server/commit/ff94dd35673bba1476594299d31ce8293b8bd223
http://secunia.com/advisories/41621
http://www.openwall.com/lists/oss-security/2010/10/01/3
http://www.openwall.com/lists/oss-security/2010/10/01/8
https://bugs.freeradius.org/bugzilla/show_bug.cgi?id=35
https://bugzilla.redhat.com/show_bug.cgi?id=639397
http://freeradius.org/press/index.html#2.1.10
http://github.com/alandekok/freeradius-server/commit/ff94dd35673bba1476594299d31ce8293b8bd223
http://secunia.com/advisories/41621
http://www.openwall.com/lists/oss-security/2010/10/01/3
http://www.openwall.com/lists/oss-security/2010/10/01/8

Get alerted when CVE-2010-3697 or the next vulnerability affects your stack