Vulnerability-Lookup

RHSA-2026:85277

Vulnerability from csaf_redhat - Published: 2026-10-19 20:23 - Updated: 2026-10-19 23:40

Summary

Red Hat Security Advisory: hostapd security update

Severity

Moderate

Notes

Topic: An update for hostapd is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server. hostapd is designed to be a "daemon" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd. Security Fix(es): * hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-58374

A flaw was found in hostapd. An unauthenticated attacker within wireless range can send a specially crafted management frame during Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing. This crafted frame, containing a malformed Multi-Link Element or Per-STA Profile subelement, can lead to an out-of-bounds write and memory corruption. The primary consequence of this vulnerability is a denial of service (DoS) due to the termination of the hostapd process.

7.1 (High)


                
                  CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.src	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.x86_64	—	Vendor Fix fix

Threats

Impact Moderate

References

13 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:85277	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2494924	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-58374	self
https://bugzilla.redhat.com/show_bug.cgi?id=2494924	external
https://www.cve.org/CVERecord?id=CVE-2026-58374	external
https://nvd.nist.gov/vuln/detail/CVE-2026-58374	external
https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4f…	external
https://git.w1.fi/cgit/hostap/commit/?id=aa9d3458…	external
https://w1.fi/security/2026-1/	external
https://w1.fi/security/2026-1/missing-ml-parsing-…	external
https://www.openwall.com/lists/oss-security/2026/…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for hostapd is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "hostapd is a user space daemon for access point and authentication servers. It implements IEEE 802.11 access point management, IEEE 802.1X/WPA/WPA2/EAP Authenticators and RADIUS authentication server.  hostapd is designed to be a \"daemon\" program that runs in the back-ground and acts as the backend component controlling authentication. hostapd supports separate frontend programs and an example text-based frontend, hostapd_cli, is included with hostapd.\n\nSecurity Fix(es):\n\n* hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request (CVE-2026-58374)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:85277",
        "url": "https://access.redhat.com/errata/RHSA-2026:85277"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2494924",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494924"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85277.json"
      }
    ],
    "title": "Red Hat Security Advisory: hostapd security update",
    "tracking": {
      "current_release_date": "2026-10-19T23:40:25+00:00",
      "generator": {
        "date": "2026-10-19T23:40:25+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:85277",
      "initial_release_date": "2026-10-19T20:23:07+00:00",
      "revision_history": [
        {
          "date": "2026-10-19T20:23:07+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-19T20:23:07+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-19T23:40:25+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-0:2.11-3.el9_8.src",
                "product": {
                  "name": "hostapd-0:2.11-3.el9_8.src",
                  "product_id": "hostapd-0:2.11-3.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd@2.11-3.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-0:2.11-3.el9_8.aarch64",
                "product": {
                  "name": "hostapd-0:2.11-3.el9_8.aarch64",
                  "product_id": "hostapd-0:2.11-3.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd@2.11-3.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hostapd-debugsource-0:2.11-3.el9_8.aarch64",
                "product": {
                  "name": "hostapd-debugsource-0:2.11-3.el9_8.aarch64",
                  "product_id": "hostapd-debugsource-0:2.11-3.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd-debugsource@2.11-3.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hostapd-debuginfo-0:2.11-3.el9_8.aarch64",
                "product": {
                  "name": "hostapd-debuginfo-0:2.11-3.el9_8.aarch64",
                  "product_id": "hostapd-debuginfo-0:2.11-3.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd-debuginfo@2.11-3.el9_8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-0:2.11-3.el9_8.ppc64le",
                "product": {
                  "name": "hostapd-0:2.11-3.el9_8.ppc64le",
                  "product_id": "hostapd-0:2.11-3.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd@2.11-3.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hostapd-debugsource-0:2.11-3.el9_8.ppc64le",
                "product": {
                  "name": "hostapd-debugsource-0:2.11-3.el9_8.ppc64le",
                  "product_id": "hostapd-debugsource-0:2.11-3.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd-debugsource@2.11-3.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hostapd-debuginfo-0:2.11-3.el9_8.ppc64le",
                "product": {
                  "name": "hostapd-debuginfo-0:2.11-3.el9_8.ppc64le",
                  "product_id": "hostapd-debuginfo-0:2.11-3.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd-debuginfo@2.11-3.el9_8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-0:2.11-3.el9_8.s390x",
                "product": {
                  "name": "hostapd-0:2.11-3.el9_8.s390x",
                  "product_id": "hostapd-0:2.11-3.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd@2.11-3.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hostapd-debugsource-0:2.11-3.el9_8.s390x",
                "product": {
                  "name": "hostapd-debugsource-0:2.11-3.el9_8.s390x",
                  "product_id": "hostapd-debugsource-0:2.11-3.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd-debugsource@2.11-3.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hostapd-debuginfo-0:2.11-3.el9_8.s390x",
                "product": {
                  "name": "hostapd-debuginfo-0:2.11-3.el9_8.s390x",
                  "product_id": "hostapd-debuginfo-0:2.11-3.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd-debuginfo@2.11-3.el9_8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hostapd-0:2.11-3.el9_8.x86_64",
                "product": {
                  "name": "hostapd-0:2.11-3.el9_8.x86_64",
                  "product_id": "hostapd-0:2.11-3.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd@2.11-3.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hostapd-debugsource-0:2.11-3.el9_8.x86_64",
                "product": {
                  "name": "hostapd-debugsource-0:2.11-3.el9_8.x86_64",
                  "product_id": "hostapd-debugsource-0:2.11-3.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd-debugsource@2.11-3.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "hostapd-debuginfo-0:2.11-3.el9_8.x86_64",
                "product": {
                  "name": "hostapd-debuginfo-0:2.11-3.el9_8.x86_64",
                  "product_id": "hostapd-debuginfo-0:2.11-3.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/hostapd-debuginfo@2.11-3.el9_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-0:2.11-3.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.aarch64"
        },
        "product_reference": "hostapd-0:2.11-3.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-0:2.11-3.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.ppc64le"
        },
        "product_reference": "hostapd-0:2.11-3.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-0:2.11-3.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.s390x"
        },
        "product_reference": "hostapd-0:2.11-3.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-0:2.11-3.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.src"
        },
        "product_reference": "hostapd-0:2.11-3.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-0:2.11-3.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.x86_64"
        },
        "product_reference": "hostapd-0:2.11-3.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-debuginfo-0:2.11-3.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.aarch64"
        },
        "product_reference": "hostapd-debuginfo-0:2.11-3.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-debuginfo-0:2.11-3.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.ppc64le"
        },
        "product_reference": "hostapd-debuginfo-0:2.11-3.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-debuginfo-0:2.11-3.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.s390x"
        },
        "product_reference": "hostapd-debuginfo-0:2.11-3.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-debuginfo-0:2.11-3.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.x86_64"
        },
        "product_reference": "hostapd-debuginfo-0:2.11-3.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-debugsource-0:2.11-3.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.aarch64"
        },
        "product_reference": "hostapd-debugsource-0:2.11-3.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-debugsource-0:2.11-3.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.ppc64le"
        },
        "product_reference": "hostapd-debugsource-0:2.11-3.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-debugsource-0:2.11-3.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.s390x"
        },
        "product_reference": "hostapd-debugsource-0:2.11-3.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hostapd-debugsource-0:2.11-3.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.x86_64"
        },
        "product_reference": "hostapd-debugsource-0:2.11-3.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-58374",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-06-30T14:01:58.042253+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494924"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in hostapd. An unauthenticated attacker within wireless range can send a specially crafted management frame during Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing. This crafted frame, containing a malformed Multi-Link Element or Per-STA Profile subelement, can lead to an out-of-bounds write and memory corruption. The primary consequence of this vulnerability is a denial of service (DoS) due to the termination of the hostapd process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-58374"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494924",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494924"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-58374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-58374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58374"
        },
        {
          "category": "external",
          "summary": "https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187",
          "url": "https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187"
        },
        {
          "category": "external",
          "summary": "https://git.w1.fi/cgit/hostap/commit/?id=aa9d345887389a251c63a3781d2ad2940d079193",
          "url": "https://git.w1.fi/cgit/hostap/commit/?id=aa9d345887389a251c63a3781d2ad2940d079193"
        },
        {
          "category": "external",
          "summary": "https://w1.fi/security/2026-1/",
          "url": "https://w1.fi/security/2026-1/"
        },
        {
          "category": "external",
          "summary": "https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt",
          "url": "https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/06/30/1",
          "url": "https://www.openwall.com/lists/oss-security/2026/06/30/1"
        }
      ],
      "release_date": "2026-06-30T12:35:54.440000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-19T20:23:07+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:85277"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-0:2.11-3.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debuginfo-0:2.11-3.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:hostapd-debugsource-0:2.11-3.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "hostapd: hostapd: Denial of Service via malformed Wi-Fi 7 Multi-Link Operation association request"
    }
  ]
}

CVE-2026-58374 (GCVE-0-2026-58374)

Vulnerability from cvelistv5 – Published: 2026-06-30 12:35 – Updated: 2026-06-30 13:38

Summary

In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-30 13:38 UTC

CWE

CWE-193 - Off-by-one Error

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2324 records in the last 180 days details

References

5 references

URL	Tags
https://w1.fi/security/2026-1/missing-ml-parsing-…	vendor-advisory
https://w1.fi/security/2026-1/	vendor-advisorypatch
https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4f…	patch
https://git.w1.fi/cgit/hostap/commit/?id=aa9d3458…	patch
https://www.openwall.com/lists/oss-security/2026/…

Impacted products

1 product

Vendor	Product	Version
w1.fi	hostapd	Affected: 0 , < 2.12 (custom) cpe:2.3:a:w1.fi:hostapd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-30T13:38:17.879838Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-30T13:38:26.434Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hostapd",
          "vendor": "w1.fi",
          "versions": [
            {
              "lessThan": "2.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:w1.fi:hostapd:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In hostapd_process_ml_assoc_req() in src/ap/ieee802_11_eht.c, the received link_id field can be parsed as value 15, but the corresponding links[] storage only has valid entries for lower link IDs (0 through 14). This causes an out-of-bounds write / small memory corruption during association processing before the 4-way handshake. The attack does not require network credentials, prior authentication, or user interaction. The confirmed practical impact is denial of service through hostapd process termination. This affects hostapd v2.11 and newer development snapshots before v2.12 when built with CONFIG_IEEE80211BE enabled. The issue is fixed in hostapd v2.12 and the upstream 2026-1 fixes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-193",
              "description": "CWE-193 Off-by-one Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-30T12:35:54.440Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "hostap security advisory 2026-1: Missing multi-link parsing validation in wpa_supplicant and hostapd",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt"
        },
        {
          "name": "hostap security advisory 2026-1 patch directory",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://w1.fi/security/2026-1/"
        },
        {
          "name": "Fix commit 46dd5a4 - missing link ID bounds check",
          "tags": [
            "patch"
          ],
          "url": "https://git.w1.fi/cgit/hostap/commit/?id=46dd5a4ffc9bcf44cf8fc45120b3e1e5ec922187"
        },
        {
          "name": "Fix commit aa9d345 - BSS bounds check for link_id",
          "tags": [
            "patch"
          ],
          "url": "https://git.w1.fi/cgit/hostap/commit/?id=aa9d345887389a251c63a3781d2ad2940d079193"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/06/30/1"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-58374",
    "datePublished": "2026-06-30T12:35:54.440Z",
    "dateReserved": "2026-06-30T12:35:53.986Z",
    "dateUpdated": "2026-06-30T13:38:26.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted