HO
Product
hostapd
41
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 10Medium 17Low 2
Watch
Add hostapd to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-23304 | 9.8 | Jan 17 | The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns Affected: before 2.10 |
| CVE-2022-23303 | 9.8 | Jan 17 | The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns Affected: before 2.10 |
| CVE-2019-9499 | 8.1 | Apr 17 | The implementations of EAP-PWD in wpa_supplicant EAP Peer, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and… Affected: through 2.4; 2.5 through 2.7 |
| CVE-2019-9498 | 8.1 | Apr 17 | The implementations of EAP-PWD in hostapd EAP Server, when built against a crypto library missing explicit validation on imported elements, do not validate the scalar and element… Affected: through 2.4; 2.5 through 2.7 |
| CVE-2019-9497 | 8.1 | Apr 17 | The implementations of EAP-PWD in hostapd EAP Server and wpa_supplicant EAP Peer do not validate the scalar and element values in EAP-pwd-Commit Affected: through 2.4; 2.5 through 2.7 |
| CVE-2017-13082 | 8.1 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT)… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2020-12695 | 7.5 | Jun 8 | The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment… Affected: before 2.0.0 |
| CVE-2019-10064 | 7.5 | Feb 28 | hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate… Affected: before 2.6 |
| CVE-2019-9496 | 7.5 | Apr 17 | An invalid authentication sequence could result in the hostapd process terminating due to missing state validation steps when processing the SAE confirm message when in hostapd/AP… Affected: through 2.7 |
| CVE-2016-10743 | 7.5 | Mar 23 | hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call Affected: before 2.6 |
| CVE-2016-4476 | 7.5 | May 9 | hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows remote attackers to cause a denial of… Affected: 0.6.7 through 2.5 |
| CVE-2026-58374 | 7.1 | Jun 30 | In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker… Affected: before 2.12 |
| CVE-2017-13086 | 6.8 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshake, allowing an attacker within radio… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2017-13084 | 6.8 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey handshake, allowing an attacker within… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2017-13077 | 6.8 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the four-way handshake, allowing an attacker within radio… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2022-37660 | 6.5 | Feb 11 | In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association Affected: through 2.10 |
| CVE-2019-5062 | 6.5 | Dec 12 | An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions Affected: 2.6 |
| CVE-2019-5061 | 6.5 | Dec 12 | An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required… Affected: 2.6 |
| CVE-2019-16275 | 6.5 | Sep 12 | hostapd before 2.10 and wpa_supplicant before 2.10 allow an incorrect indication of disconnection in certain situations because source address validation is mishandled Affected: through 2.9 |
| CVE-2019-13377 | 5.9 | Aug 15 | The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel attacks as a result of observable timing differences and cache… Affected: 2.0 through 2.8 |
| CVE-2019-11555 | 5.9 | Apr 26 | The EAP-pwd implementation in hostapd (EAP server) before 2.8 and wpa_supplicant (EAP peer) before 2.8 does not validate fragmentation reassembly state properly for a case where… Affected: before 2.8 |
| CVE-2019-9494 | 5.9 | Apr 17 | The implementations of SAE in hostapd and wpa_supplicant are vulnerable to side channel attacks as a result of observable timing differences and cache access patterns Affected: through 2.7 |
| CVE-2021-30004 | 5.3 | Apr 2 | In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c Affected: 2.9 |
| CVE-2017-13088 | 5.3 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing a Wireless Network Management (WNM)… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2017-13087 | 5.3 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2017-13081 | 5.3 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the group key handshake, allowing an… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2017-13080 | 5.3 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2017-13079 | 5.3 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the Integrity Group Temporal Key (IGTK) during the four-way handshake, allowing an… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2017-13078 | 5.3 | Oct 17 | Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames… Affected: 0.2.4; 0.2.5; 0.2.6; 0.2.8; 0.3.7; 0.3.9; +25 more |
| CVE-2025-24912 | 3.7 | Mar 12 | hostapd fails to process crafted RADIUS packets properly Affected: through 2.11 |
| CVE-2019-9495 | 3.7 | Apr 17 | The implementations of EAP-PWD in hostapd and wpa_supplicant are vulnerable to side-channel attacks as a result of cache access patterns Affected: through 2.7 |
| CVE-2015-8041 | – | Nov 9 | Multiple integer overflows in the NDEF record parser in hostapd before 2.5 and wpa_supplicant before 2.5 allow remote attackers to cause a denial of service (process crash or… Affected: through 2.4 |
| CVE-2015-4146 | – | Jun 15 | The EAP-pwd peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not clear the L (Length) and M (More) flags before determining if a response should be… Affected: 1.0; 1.1; 2.0; 2.1; 2.2; 2.3; +1 more |
| CVE-2015-4145 | – | Jun 15 | The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate a fragment is already being processed, which allows remote attackers to… Affected: 1.0; 1.1; 2.0; 2.1; 2.2; 2.3; +1 more |
| CVE-2015-4144 | – | Jun 15 | The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 does not validate that a message is long enough to contain the Total-Length field, which… Affected: 1.0; 1.1; 2.0; 2.1; 2.2; 2.3; +1 more |
| CVE-2015-4143 | – | Jun 15 | The EAP-pwd server and peer implementation in hostapd and wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a… Affected: 1.0; 1.1; 2.0; 2.1; 2.2; 2.3; +1 more |
| CVE-2015-4142 | – | Jun 15 | Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote… Affected: 0.7.0; 0.7.1; 0.7.2; 0.7.3; 1.0; 1.1; +5 more |
| CVE-2015-4141 | – | Jun 15 | The WPS UPnP function in hostapd, when using WPS AP, and wpa_supplicant, when using WPS external registrar (ER), 0.7.0 through 2.4 allows remote attackers to cause a denial of… Affected: 0.7.0; 0.7.1; 0.7.2; 0.7.3; 1.0; 1.1; +5 more |
| CVE-2014-3686 | – | Oct 16 | wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute… Affected: 0.7.2; 1.0; 1.1; 2.0; 2.1; 2.2 |
| CVE-2012-4445 | – | Oct 10 | Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote… Affected: 0.6.0; 0.6.1; 0.6.2; 0.6.3; 0.6.4; 0.6.5; +7 more |
| CVE-2012-2389 | – | Jun 21 | hostapd 0.7.3, and possibly other versions before 1.0, uses 0644 permissions for /etc/hostapd/hostapd.conf, which might allow local users to obtain sensitive information such as… Affected: 0.7.3 |
Showing 41