CVE-2024-3596, known as Blast-RADIUS, is a critical protocol weakness (CVSS 9.0) in RADIUS over UDP. An attacker on the network path can use an MD5 chosen-prefix collision to turn one valid server response into another, such as changing a reject into an accept. Update clients and servers, require Message-Authenticator, and move to TLS or DTLS.
Weakness class: CWE-354, CWE-924.
What's affected
- Protocol: RADIUS as defined in RFC 2865, when run over UDP without Message-Authenticator enforced.
- Products in the record: FreeRADIUS, Broadcom Brocade SANnav and Fabric OS, SonicWall SonicOS, and others. The vendor list is long, since this is a protocol flaw.
- Not affected, per the oss-security post: servers that only perform EAP, because EAP requires Message-Authenticator, and RADIUS over TLS or DTLS.
- RADIUS over TCP may still be susceptible in more advanced on-path scenarios.
- Fixed versions: the oss-security post lists none for FreeRADIUS and points to the FreeRADIUS security page. Check each vendor's advisory.
- Severity: Critical, CVSS 9.0, per the record. The KEV flag is false.
How to check if you're exposed
- Inventory everything that speaks RADIUS: VPN gateways, Wi-Fi controllers, switches, firewalls and the servers behind them.
- For each pair, note the transport. UDP is the case at issue. TLS or DTLS is not affected.
- Check whether the server and client require Message-Authenticator on every request and response.
- Check the version of FreeRADIUS or your vendor's RADIUS server against the vendor advisory.
- Map where RADIUS traffic travels, and whether it crosses any network an attacker could sit on.
What to do now
- Update RADIUS clients and servers to releases the vendors name in their advisories.
- Require Message-Authenticator for RADIUS authentication, at minimum.
- Move to RADIUS over TLS or DTLS where both ends support it.
- Isolate RADIUS traffic on a dedicated network, or carry it over a secure VPN tunnel.
- Read the NetworkRADIUS paper on MD5 collisions for deployment guidance.
Why it matters
The record lists CWE-354, improper validation of integrity check value, and CWE-924, improper enforcement of message integrity during transmission. The protocol authenticates responses with an MD5 based value. MD5 has been known to be weak for years, and the research shows a chosen-prefix collision can be turned into a practical forgery.
The scariest consequence in the oss-security post is multi-factor bypass. If a server sends an Access-Challenge asking for a second factor, an attacker in the middle could change it into an Access-Accept. That needs the attacker to be on the path, so isolation of RADIUS traffic is a real control, not a formality.
This is a design level issue, so patching is partly about defaults. Enforcing Message-Authenticator closes the door the attack uses.
Quick check
Does EAP protect me?
The oss-security post says servers that only perform EAP are unaffected, because EAP requires Message-Authenticator.
What is the single best fix?
Move to RADIUS over TLS or DTLS, which the post says is not affected. Where you cannot, require Message-Authenticator.
Sources
Last reviewed: 19 October 2026.
