Strongswan
This hub aggregates every CVE we track for Strongswan, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
52
CVEs tracked
5
Critical
20
High
0
In CISA KEV
Severity distribution
MEDIUM22HIGH20LOW5CRITICAL5
Monthly trend
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
1
11
2024-102026-09
Latest CVEs
The 15 most recently published vulnerabilities affecting Strongswan.
- CVE-2026-78135libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.5.6
- CVE-2026-78134strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.7.1
- CVE-2026-78133libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.7.5
- CVE-2026-78132strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.7.5
- CVE-2026-78131strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.3.7
- CVE-2026-78130strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.7.5
- CVE-2026-78129strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.5.9
- CVE-2026-78127libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.3.7
- CVE-2026-78126strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.5.9
- CVE-2026-78124strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.3.7
- CVE-2026-78123strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.5.9
- CVE-2026-47895In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the d...7.5
- CVE-2026-25075strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow7.5
- CVE-2025-62291In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow that potentially ...8.1
- CVE-2022-4967strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clie...7.7
Product normalization is registry-driven with AI assist and human review. How it works