Strongswan: >> Strongswan >> 5.9.9 Security Vulnerabilities
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.
CVSS Score
5.6
EPSS Score
0.003
Published
2026-09-11
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
CVSS Score
5.9
EPSS Score
0.004
Published
2026-09-11
strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.
CVSS Score
3.7
EPSS Score
0.002
Published
2026-09-11
strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-09-11
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.
CVSS Score
7.1
EPSS Score
0.003
Published
2026-09-11
strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.
CVSS Score
7.5
EPSS Score
0.003
Published
2026-09-11
strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.
CVSS Score
3.7
EPSS Score
0.002
Published
2026-09-11
strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.
CVSS Score
5.9
EPSS Score
0.004
Published
2026-09-11
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
CVSS Score
9.8
EPSS Score
0.023
Published
2023-12-07
strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.
CVSS Score
9.8
EPSS Score
0.023
Published
2023-04-15
Page 1