Unchecked Input for Loop Condition in strongSwan - CVE-2026-78129
Published: September 22, 2026
Vulnerability identifier: #VU151589
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-78129
CWE-ID: CWE-606
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to missing bounds validation of PKCS#5 parameters in the PKCS#5 implementation in libstrongswan when processing an encrypted PKCS#7 container received via an IKEv1 certificate payload. A remote attacker can send a crafted encrypted PKCS#7 container to cause a denial of service.
Remote exploitation requires the pkcs7 plugin to be loaded and IKEv1 to be accepted.
Affected software
strongSwan
Debian Linux
strongswan (Debian package)
Debian Linux
strongswan (Debian package)
How to mitigate CVE-2026-78129
Install security update from vendor's website.
strongSwan - update to 6.1.0
strongswan (Debian package) - update to 6.0.1-6+deb13u7
strongswan (Debian package) - update to 6.0.1-6+deb13u7