Hostapd vulnerabilities

3 known vulnerabilities in Hostapd from W1.fi. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  hostapd: Off-by-one Error

  CVE-2026-58374Jun 30, 2026W1.fi

  In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi

• 9.8 Critical severity

  SIDIS Secured SmartPlug: Observable Discrepancy

  CVE-2022-23304Jan 17, 2022SiemensEPSS 2.05%

  The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9495.

• 9.8 Critical severity

  SIDIS Secured SmartPlug: Observable Discrepancy

  CVE-2022-23303Jan 17, 2022SiemensEPSS 3.28%

  The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. NOTE: this issue exists because of an incomplete fix for CVE-2019-9494.