SB2026092253 - Fedora 43 update for strongswan
Published: September 22, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Double free (CVE-ID: CVE-2026-47895)
CWE-ID: CWE-415 - Double Free
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to potentially execute arbitrary code.
The vulnerability exists due to a double free in the identification_t class clone() method when processing a crafted empty EAP identity. A remote attacker can send a crafted EAP identity to potentially execute arbitrary code.
2) Integer underflow (CVE-ID: CVE-2026-25075)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an integer underflow in the eap-ttls plugin when processing EAP-TTLS attribute-value pairs. A remote attacker can send a crafted EAP-TTLS message to cause a denial of service.
3) Infinite loop (CVE-ID: CVE-2026-35328)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an incorrect loop condition in libtls tls_server.c::process_client_hello() when processing a supported_versions TLS extension with a length that is not a multiple of two bytes. A remote attacker can send a crafted ClientHello message to exhaust the daemon's thread pool and cause a denial of service.
The extension is parsed even when TLS 1.3 is disabled.
4) NULL pointer dereference (CVE-ID: CVE-2026-35329)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing zero-length input validation in the PKCS#5 implementation in libstrongswan and the PKCS#7 implementation in the pkcs7 plugin when processing empty encrypted PKCS#7 or PKCS#5 structures. A remote attacker can supply an empty encrypted structure to trigger a null-pointer dereference and cause a crash.
Remote exploitation is possible via IKEv1 CERT payloads containing PKCS#7-wrapped X.509 certificates.
5) Integer underflow (CVE-ID: CVE-2026-35330)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to integer underflow in libsimaka when processing crafted EAP-SIM/AKA attributes with a zero length field. A remote attacker can send a specially crafted EAP-SIM/AKA attribute to execute arbitrary code.
Exploitation requires EAP-SIM/AKA authentication to be processed by libsimaka.
6) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-35331)
CWE-ID: CWE-178 - Improper Handling of Case Sensitivity
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to authenticate with certificates that violate excluded X.509 name constraints.
The vulnerability exists due to improper handling of case sensitivity in the constraints plugin when validating X.509 name constraints. A remote user can vary the case of a certificate identity to authenticate with a certificate that violates excluded name constraints.
Only deployments using excluded name constraints are vulnerable.
7) NULL pointer dereference (CVE-ID: CVE-2026-35332)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null-pointer dereference in libtls server-side ECDH public-value processing when handling an empty ECDH public value in a TLS client_key_exchange message before TLS 1.3. A remote attacker can send a specially crafted TLS client_key_exchange message to cause a denial of service.
The crash occurs when the TLS record ends immediately after the length byte for the empty public value.
8) Integer overflow (CVE-ID: CVE-2026-35333)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer underflow in libradius when processing crafted RADIUS attributes. A remote attacker can inject a crafted RADIUS message containing an undersized attribute to cause a denial of service.
The issue affects deployments using the eap-radius or tnc-pdp plugins; unsolicited RADIUS messages are accepted when the non-default Dynamic Authorization Extension is enabled.
9) NULL pointer dereference (CVE-ID: CVE-2026-35334)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null-pointer dereference in the gmp plugin's RSA decryption handling when processing an RSA ciphertext whose decryption result is zero. A remote attacker can send a crafted RSA ciphertext to cause a denial of service.
The condition can occur with an all-zero ciphertext or ciphertext that is a multiple of the RSA modulus.
10) Improper preservation of permissions (CVE-ID: CVE-2025-9615)
CWE-ID: CWE-281 - Improper preservation of permissions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to improper preservation of permissions in multiple components of the application. A local user can view files of other users on the system.
11) Integer underflow (CVE-ID: CVE-2025-62291)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the eap-mschapv2 plugin when handling failure requests. A remote attacker can trick the victim into connecting to a malicious server, trigger an integer underflow and execute arbitrary code on the target system.
Remediation
Install update from vendor's website.