PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47895 strongSwan CVE debrief

A double-free vulnerability exists in strongSwan before version 6.0.7 due to mishandled identity parsing and cloning. Specifically, parsed EAP-Identities resulting in an empty but non-NULL encoding are not correctly cloned, leading to a double-free when duplicates are destroyed. This vulnerability can lead to potential denial of service and remote code execution if exploited. Defenders should verify exposure of strongSwan installations and prioritize upgrading to version 6.0.7 or later.

Vendor
strongSwan
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-22
Original CVE updated
2026-09-09
Advisory published
2026-08-22
Advisory updated
2026-09-09

Who should care

Defenders responsible for strongSwan installations should assess exposure and prioritize upgrading to version 6.0.7 or later. This involves verifying the version of strongSwan in use, identifying potentially affected deployments, and planning for remediation. Security teams and vulnerability management teams should also review the vulnerability and plan for mitigation if necessary.

Why it matters

CVE-2026-47895 is a high-severity vulnerability in strongSwan that requires verification of exposure and prompt remediation to prevent potential denial of service and remote code execution.

  • Potential denial of service due to double-free error
  • Possible remote code execution if exploited
  • Verification of strongSwan version and exposure is necessary
  • Remediation requires upgrading to strongSwan version 6.0.7 or later

Technical summary

The vulnerability exists due to mishandled identity parsing and cloning in strongSwan before version 6.0.7. Parsed EAP-Identities resulting in an empty but non-NULL encoding are not correctly cloned, leading to a double-free when duplicates are destroyed.

Defensive priority

Defenders should prioritize verifying exposure of strongSwan installations and upgrading to version 6.0.7 or later.

Recommended defensive actions

  • Verify strongSwan installations for exposure
  • Upgrade to strongSwan version 6.0.7 or later
  • Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and potential impact. However, additional information on affected deployments and exploitation attempts is limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47895 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47895

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47895 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47895

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.