Memory leak in strongSwan - CVE-2026-78127
Published: September 22, 2026
Vulnerability identifier: #VU151590
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-78127
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a memory leak in libcharon IKE message stringification when processing crafted IKE messages whose string representations exceed a fixed-size buffer. A remote attacker can send a large number of specially crafted IKE messages to cause a denial of service.
Built-in denial-of-service protections slow memory exhaustion but do not prevent it entirely, particularly on systems with tight memory constraints.
Affected software
strongSwan
Debian Linux
strongswan (Debian package)
Debian Linux
strongswan (Debian package)
How to mitigate CVE-2026-78127
Install security update from vendor's website.
strongSwan - update to 6.1.0
strongswan (Debian package) - update to 6.0.1-6+deb13u7
strongswan (Debian package) - update to 6.0.1-6+deb13u7