CVE-2026-78124
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.
Risk Assessment
The memory leak may lead to gradual resource exhaustion and eventually to denial of service (DoS).
Recommendation
Update strongSwan to a version later than 6.0.7.
Other vulnerabilities in strongSwan
See all- CVE-2017-9023High
The ASN.1 parser in strongSwan before version 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, allowing remote attackers to cause a denial of service (infinite loop) via a crafted certificate.
- CVE-2015-3991Critical
strongSwan versions 5.2.2 and 5.3.0 allow remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
- CVE-2026-78135Medium
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.
- CVE-2026-78134High
strongSwan 4.5.0 through 6.0.7 has incorrect access control in the eap-ttls and eap-peap plugins because the inner EAP identity may be missing or mismatched.
- CVE-2026-78133High
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.
- CVE-2026-78132High
strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
- CVE-2026-78131Low
strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.
- CVE-2026-78130High
strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.
- CVE-2026-78129Medium
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
- CVE-2026-78127Low
libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.
Original NVD description (English source)
strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS