Double free in strongSwan - CVE-2026-47895

Vulnerability identifier: #VU151579

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47895

CWE-ID: CWE-415

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to potentially execute arbitrary code.

The vulnerability exists due to a double free in the identification_t class clone() method when processing a crafted empty EAP identity. A remote attacker can send a crafted EAP identity to potentially execute arbitrary code.

strongSwan
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Workstation Extension 15
Basesystem Module
SUSE Package Hub 15
Ubuntu
Fedora
libstrongswan (Ubuntu package)
strongswan (Ubuntu package)
strongswan-libs0
strongswan-hmac
strongswan-libs0-debuginfo
strongswan-ipsec-debuginfo
strongswan-ipsec
strongswan-debuginfo
strongswan
strongswan-debugsource
strongswan-doc
strongswan-nm-debuginfo
strongswan-nm
strongswan (Debian package)

Install security update from vendor's website.

strongSwan - update to 6.0.7
libstrongswan (Ubuntu package) - addressed in versions 5.9.5-2ubuntu2.7, 5.9.13-2ubuntu4.24.04.4, 6.0.1-6ubuntu4.4, 6.0.4-1ubuntu3.1
strongswan (Ubuntu package) - addressed in versions 5.9.5-2ubuntu2.7, 5.9.13-2ubuntu4.24.04.4, 6.0.1-6ubuntu4.4, 6.0.4-1ubuntu3.1
strongswan-libs0 - update to 5.9.14-150700.3.21.2
strongswan-hmac - update to 5.9.14-150700.3.21.2
strongswan-libs0-debuginfo - update to 5.9.14-150700.3.21.2
strongswan-ipsec-debuginfo - update to 5.9.14-150700.3.21.2
strongswan-ipsec - update to 5.9.14-150700.3.21.2
strongswan-debuginfo - update to 5.9.14-150700.3.21.2
strongswan - update to 5.9.14-150700.3.21.2
strongswan-debugsource - update to 5.9.14-150700.3.21.2
strongswan-doc - update to 5.9.14-150700.3.21.2
strongswan-nm-debuginfo - update to 5.9.14-150700.3.21.2
strongswan-nm - update to 5.9.14-150700.3.21.2
strongswan - addressed in versions 6.0.7-1.fc44, 6.0.7-2.fc43
strongswan (Debian package) - addressed in versions 5.9.8-5+deb12u5, 6.0.1-6+deb13u6

• https://www.strongswan.org/blog/2026/06/08/strongswan-vulnerability-(cve-2026-47895).html

• Double free in strongSwan
• Debian update for strongswan
• Fedora 44 update for strongswan
• Fedora 43 update for strongswan
• SUSE update for strongswan
• Ubuntu update for strongswan