UnratedPublic exploit

Out-of-bounds read and infinite loop in libradius RADIUS attribute processing

IdentifiersCVE-2026-35333CWE-125

CVE-2026-35333 is a vulnerability in libradius affecting the processing of RADIUS attributes. According to the provided context, malformed or otherwise crafted RADIUS attributes can trigger either an infinite loop condition or an out-of-bounds read during attribute parsing. The out-of-bounds read may lead to process instability or a crash. Specific vulnerable functions, affected versions, and protocol field details are not available in the provided information.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause denial of service by forcing an application or service using libradius to hang in an infinite loop or crash due to an out-of-bounds read. Based on the available information, there is no evidence provided of code execution or privilege escalation; the demonstrated impact is service disruption and loss of availability.

Mitigation

If you can’t patch tonight, do this now.

Until a vendor fix or patched libradius version is available, reduce exposure by limiting acceptance of untrusted RADIUS traffic to trusted peers only, applying strict network ACLs around RADIUS services, and monitoring for malformed or anomalous RADIUS packets that could trigger parser failures. Where feasible, deploy process supervision or watchdog restart mechanisms to reduce downtime from crashes or hangs. Additional remediation details are not available in the provided information.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

CVE-2026-35333MaturityOperationalVerified exploit

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-35333, a pre-authentication remote denial-of-service issue in strongSwan's RADIUS handling. The repo contains only three files: a GPLv3 LICENSE, a README describing the bug and usage, and `poc.py`, the actual exploit. The exploit is not part of a larger framework. `poc.py` is the sole code file and the clear entry point. It builds a minimal malformed RADIUS Access-Request packet and sends it over UDP to a target strongSwan charon DAE listener, defaulting to `127.0.0.1:3799`. The malicious packet contains a first attribute with `length = 0`, which abuses the vulnerable `attribute_enumerate()` logic described in the README. According to the included explanation, strongSwan's DAE receive path calls `verify()` before dispatching on RADIUS code, and for Access-Request packets the verification path skips the Response-Authenticator MD5 check and walks the attribute list directly. Because the malformed zero-length attribute causes the iterator state not to advance, the parser loops forever. This means the attack is unauthenticated and only requires network access to the UDP/3799 listener. The exploit's main capability is remote CPU exhaustion / worker-thread starvation. One crafted packet is intended to pin one charon worker thread at 100% CPU indefinitely; sending multiple packets via the `--count` option can exhaust all available worker threads and produce a full denial of service. The script also includes a benign control path (`--control`) that sends a well-formed Disconnect-Request with a User-Name attribute to demonstrate expected non-hanging rejection behavior when the packet is merely unsigned rather than malformed. Structurally, the code is straightforward: helper functions construct either the malformed Access-Request or a valid control Disconnect-Request, `send_packet()` transmits the packet via a UDP socket and waits briefly for a response, and `main()` parses CLI arguments (`--target`, `--port`, `--count`, `--wait`, `--control`) and orchestrates repeated sends. There is no shell payload, persistence, post-exploitation logic, or credential theft; the repository is focused purely on demonstrating and operationalizing the network DoS condition against vulnerable strongSwan deployments.

JohannesLksDisclosed May 14, 2026pythonmarkdownnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

StrongswanStrongswanapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

2 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1