CVE-2015-5314

The eap_pwd_process function in eap_server/eap_server_pwd.c in hostapd 2.x before 2.6 does not validate that the reassembly buffer is large enough for the final fragment when used with (1) an internal EAP server or (2) a RADIUS server and EAP-pwd is enabled in a runtime configuration, which allows remote attackers to cause a denial of service (process termination) via a large final fragment in an EAP-pwd message.

• CWE-119

• http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txtMitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2015/11/10/10Mailing List, Mitigation, Patch, Third Party Advisory
• http://www.ubuntu.com/usn/USN-2808-1Broken Link
• https://www.debian.org/security/2015/dsa-3397Third Party Advisory
• http://w1.fi/security/2015-7/eap-pwd-missing-last-fragment-length-validation.txtMitigation, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2015/11/10/10Mailing List, Mitigation, Patch, Third Party Advisory
• http://www.ubuntu.com/usn/USN-2808-1Broken Link
• https://www.debian.org/security/2015/dsa-3397Third Party Advisory

Published

Feb 21, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5308Multiple SQL injection vulnerabilities in cs_admin_users.php…
• CVE-2015-5309Integer overflow in the terminal emulator in PuTTY before 0.…
• CVE-2015-5310The WNM Sleep Mode code in wpa_supplicant 2.x before 2.6 doe…
• CVE-2015-5311PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 …
• CVE-2015-5312The xmlStringLenDecodeEntities function in parser.c in libxm…
• CVE-2015-5313Directory traversal vulnerability in the virStorageBackendFi…
• CVE-2015-5315The eap_pwd_process function in eap_peer/eap_pwd.c in wpa_su…
• CVE-2015-5316The eap_pwd_perform_confirm_exchange function in eap_peer/ea…
• CVE-2015-5317The Fingerprints pages in Jenkins before 1.638 and LTS befor…7.5
• CVE-2015-5318Jenkins before 1.638 and LTS before 1.625.2 uses a publicly …
• CVE-2015-5319XML external entity (XXE) vulnerability in the create-job CL…
• CVE-2015-5320Jenkins before 1.638 and LTS before 1.625.2 do not properly …