SB2026092230 - Multiple vulnerabilities in strongSwan

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092230

SB2026092230 - Multiple vulnerabilities in strongSwan

Published: September 22, 2026

Security Bulletin ID SB2026092230
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 82% Low 18%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) NULL pointer dereference (CVE-ID: CVE-2026-78126)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a missing state check in the eap-aka plugin when processing an AKA-Synchronization-Failure message before issuing an AKA-Challenge. A remote attacker can send an unexpected AKA-Synchronization-Failure message to cause a denial of service.

The issue occurs when the request_identity option is enabled, which is the default configuration.


2) Memory leak (CVE-ID: CVE-2026-78124)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause memory leaks.

The vulnerability exists due to missing cleanup in the openssl plugin's PKCS#7 implementation when enumerating certificates in PKCS#7/CMS containers. A remote attacker can send a PKCS#7 container containing one or more certificates to cause memory leaks.

Exploitation is possible before authentication through IKEv1 certificate payloads and requires at least two messages.


3) Use of Uninitialized Variable (CVE-ID: CVE-2026-78123)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use of uninitialized stack variables in the openssl plugin when processing PKCS#7 signerInfo or recipientInfo structures encoded with subjectKeyIdentifier. A remote attacker can send a crafted IKEv1 message containing such a structure to cause a denial of service.


4) Improper Authentication (CVE-ID: CVE-2026-78135)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to establish a usable Child SA before authentication completes.

The vulnerability exists due to improper state validation in libcharon's task manager when processing CREATE_CHILD_SA requests on unestablished IKE SAs. A remote attacker can send a CREATE_CHILD_SA request during EAP authentication to establish a usable Child SA before authentication completes.

Exploitation requires EAP authentication and either no configured IP address pool or an explicit remote traffic selector.


5) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-78134)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass authorization controls by impersonating another user.

The vulnerability exists due to improper authentication of inner EAP identities in the eap-peap and eap-ttls plugins when processing tunneled EAP authentication. A remote user can authenticate with valid credentials while claiming another user's identity during the outer EAP-Identity exchange to bypass authorization controls by impersonating another user.

Exploitation requires the use of EAP-PEAP or EAP-TTLS tunneling authentication protocols.


6) Use-after-free (CVE-ID: CVE-2026-78133)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to use-after-free in libcharon's IKEv2 rekeying collision handling when processing IKE or Child SA rekeying collisions involving multiple key exchanges. A remote user can delay or withhold a CREATE_CHILD_SA response and provide missing or invalid KE payloads to execute arbitrary code.

Successful exploitation requires correctly controlling two indirections.


7) Infinite loop (CVE-ID: CVE-2026-78132)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the x509 plugin's ietfAttrSyntax ASN.1 parser when parsing a crafted X.509 attribute certificate received in an IKEv2 CERT payload. A remote attacker can send a crafted attribute certificate containing an unexpected or malformed attribute value to cause a denial of service.

Only installations that load the x509 plugin are affected.


8) Memory leak (CVE-ID: CVE-2026-78131)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in the x509 plugin's parse_directoryName() function when processing multiple GeneralName entries in the Holder or Issuer fields of an X.509 attribute certificate. A remote attacker can send a crafted X.509 attribute certificate in an IKEv2 CERT payload to cause a denial of service.


9) NULL pointer dereference (CVE-ID: CVE-2026-78130)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in the x509 plugin's attribute certificate validation when validating an X.509 attribute certificate without an issuerName field or AuthorityKeyIdentifier extension. A remote attacker can submit a specially crafted attribute certificate to cause a crash.

Exploitation requires the x509 and acert plugins to be loaded.


10) Unchecked Input for Loop Condition (CVE-ID: CVE-2026-78129)

CWE-ID: CWE-606 - Unchecked Input for Loop Condition

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing bounds validation of PKCS#5 parameters in the PKCS#5 implementation in libstrongswan when processing an encrypted PKCS#7 container received via an IKEv1 certificate payload. A remote attacker can send a crafted encrypted PKCS#7 container to cause a denial of service.

Remote exploitation requires the pkcs7 plugin to be loaded and IKEv1 to be accepted.


11) Memory leak (CVE-ID: CVE-2026-78127)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in libcharon IKE message stringification when processing crafted IKE messages whose string representations exceed a fixed-size buffer. A remote attacker can send a large number of specially crafted IKE messages to cause a denial of service.

Built-in denial-of-service protections slow memory exhaustion but do not prevent it entirely, particularly on systems with tight memory constraints.


Remediation

Install update from vendor's website.

References