CVE-2026-47895
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.
Risk Assessment
Double-free can lead to service crashes and, in extreme cases, remote code execution, posing a serious threat to VPN connection security.
Recommendation
It is recommended to immediately upgrade strongSwan to version 6.0.7 or later, which includes a fix for this issue.
Other vulnerabilities in strongSwan
See all- CVE-2017-9023High
The ASN.1 parser in strongSwan before version 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, allowing remote attackers to cause a denial of service (infinite loop) via a crafted certificate.
- CVE-2015-3991Critical
strongSwan versions 5.2.2 and 5.3.0 allow remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
- CVE-2026-25075High
strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser. Unauthenticated remote attackers can send crafted AVP data with invalid length fields during IKEv2 authentication, causing the charon IKE daemon to crash.
Original NVD description (English source)
In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.