diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
index 80a73d6..6fac2cf 100644
--- a/src/ap/ap_config.c
+++ b/src/ap/ap_config.c
@@ -768,6 +768,8 @@ void hostapd_config_free_bss(struct hostapd_bss_config *conf)
 	os_free(conf->upc);
 	for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++)
 		wpabuf_free(conf->wps_vendor_ext[i]);
+	for (i = 0; i < MAX_WPS_APPLICATION_EXTENSIONS; i++)
+		wpabuf_free(conf->wps_application_ext[i]);
 	wpabuf_free(conf->wps_nfc_dh_pubkey);
 	wpabuf_free(conf->wps_nfc_dh_privkey);
 	wpabuf_free(conf->wps_nfc_dev_pw);
diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
index c49b48f..3719f94 100644
--- a/src/ap/ap_config.h
+++ b/src/ap/ap_config.h
@@ -501,6 +501,7 @@ struct hostapd_bss_config {
 	char *model_url;
 	char *upc;
 	struct wpabuf *wps_vendor_ext[MAX_WPS_VENDOR_EXTENSIONS];
+	struct wpabuf *wps_application_ext[MAX_WPS_APPLICATION_EXTENSIONS];
 	int wps_nfc_pw_from_config;
 	int wps_nfc_dev_pw_id;
 	struct wpabuf *wps_nfc_dh_pubkey;
diff --git a/src/ap/wps_hostapd.c b/src/ap/wps_hostapd.c
index 2f1af11..5aaf33a 100644
--- a/src/ap/wps_hostapd.c
+++ b/src/ap/wps_hostapd.c
@@ -993,6 +993,31 @@ static int hostapd_wps_set_vendor_ext(struct hostapd_data *hapd,
 }
 
 
+static int hostapd_wps_set_application_ext(struct hostapd_data *hapd,
+				      struct wps_context *wps)
+{
+	int i;
+
+	for (i = 0; i < MAX_WPS_APPLICATION_EXTENSIONS; i++) {
+		wpabuf_free(wps->dev.application_ext[i]);
+		wps->dev.application_ext[i] = NULL;
+
+		if (hapd->conf->wps_application_ext[i] == NULL)
+			continue;
+
+		wps->dev.application_ext[i] =
+			wpabuf_dup(hapd->conf->wps_application_ext[i]);
+		if (wps->dev.application_ext[i] == NULL) {
+			while (--i >= 0)
+				wpabuf_free(wps->dev.application_ext[i]);
+			return -1;
+		}
+	}
+
+	return 0;
+}
+
+
 static void hostapd_free_wps(struct wps_context *wps)
 {
 	int i;
@@ -1085,6 +1110,9 @@ int hostapd_init_wps(struct hostapd_data *hapd,
 	if (hostapd_wps_set_vendor_ext(hapd, wps) < 0)
 		goto fail;
 
+	if (hostapd_wps_set_application_ext(hapd, wps) < 0)
+		goto fail;
+
 	wps->dev.os_version = WPA_GET_BE32(hapd->conf->os_version);
 
 	if (conf->wps_rf_bands) {
@@ -1319,6 +1347,7 @@ void hostapd_update_wps(struct hostapd_data *hapd)
 #endif /* CONFIG_WPS_UPNP */
 
 	hostapd_wps_set_vendor_ext(hapd, hapd->wps);
+	hostapd_wps_set_application_ext(hapd, hapd->wps);
 
 	if (hapd->conf->wps_state)
 		wps_registrar_update_ie(hapd->wps->registrar);
diff --git a/src/wps/wps.h b/src/wps/wps.h
index 9963c46..8605490 100644
--- a/src/wps/wps.h
+++ b/src/wps/wps.h
@@ -66,6 +66,10 @@ struct wps_credential {
 #define WPS_MAX_VENDOR_EXT_LEN 1024
 /* maximum number of parsed WPS vendor extension attributes */
 #define MAX_WPS_PARSE_VENDOR_EXT 10
+/* maximum number of advertised WPS application extension attributes */
+#define MAX_WPS_APPLICATION_EXTENSIONS 10
+/* maximum size of WPS application extension attribute */
+#define WPS_MAX_APPLICATION_EXT_LEN 1024
 
 /**
  * struct wps_device_data - WPS Device Data
@@ -98,6 +102,7 @@ struct wps_device_data {
 	u16 config_methods;
 	struct wpabuf *vendor_ext_m1;
 	struct wpabuf *vendor_ext[MAX_WPS_VENDOR_EXTENSIONS];
+	struct wpabuf *application_ext[MAX_WPS_APPLICATION_EXTENSIONS];
 
 	int p2p;
 	u8 multi_ap_ext;
diff --git a/src/wps/wps_dev_attr.c b/src/wps/wps_dev_attr.c
index b209fea..0cc312e 100644
--- a/src/wps/wps_dev_attr.c
+++ b/src/wps/wps_dev_attr.c
@@ -242,6 +242,25 @@ int wps_build_vendor_ext(struct wps_device_data *dev, struct wpabuf *msg)
 }
 
 
+int wps_build_application_ext(struct wps_device_data *dev, struct wpabuf *msg)
+{
+	int i;
+
+	for (i = 0; i < MAX_WPS_APPLICATION_EXTENSIONS; i++) {
+		if (dev->application_ext[i] == NULL)
+			continue;
+		wpa_hexdump(MSG_DEBUG, "WPS:  * Application Extension",
+			    wpabuf_head_u8(dev->application_ext[i]),
+			    wpabuf_len(dev->application_ext[i]));
+		wpabuf_put_be16(msg, ATTR_APPLICATION_EXT);
+		wpabuf_put_be16(msg, wpabuf_len(dev->application_ext[i]));
+		wpabuf_put_buf(msg, dev->application_ext[i]);
+	}
+
+	return 0;
+}
+
+
 static int wps_process_manufacturer(struct wps_device_data *dev, const u8 *str,
 				    size_t str_len)
 {
diff --git a/src/wps/wps_registrar.c b/src/wps/wps_registrar.c
index 0ac5b28..3de7736 100644
--- a/src/wps/wps_registrar.c
+++ b/src/wps/wps_registrar.c
@@ -1331,7 +1331,8 @@ static int wps_set_ie(struct wps_registrar *reg)
 	    wps_build_sel_pbc_reg_uuid_e(reg, beacon) ||
 	    (reg->dualband && wps_build_rf_bands(&reg->wps->dev, beacon, 0)) ||
 	    wps_build_wfa_ext(beacon, 0, auth_macs, count, 0) ||
-	    wps_build_vendor_ext(&reg->wps->dev, beacon)) {
+	    wps_build_vendor_ext(&reg->wps->dev, beacon) ||
+	    wps_build_application_ext(&reg->wps->dev, beacon)) {
 		wpabuf_free(beacon);
 		wpabuf_free(probe);
 		return -1;
@@ -1361,7 +1362,8 @@ static int wps_set_ie(struct wps_registrar *reg)
 	    wps_build_probe_config_methods(reg, probe) ||
 	    (reg->dualband && wps_build_rf_bands(&reg->wps->dev, probe, 0)) ||
 	    wps_build_wfa_ext(probe, 0, auth_macs, count, 0) ||
-	    wps_build_vendor_ext(&reg->wps->dev, probe)) {
+	    wps_build_vendor_ext(&reg->wps->dev, probe) ||
+	    wps_build_application_ext(&reg->wps->dev, probe)) {
 		wpabuf_free(beacon);
 		wpabuf_free(probe);
 		return -1;
