PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-78127 strongSwan CVE debrief

A memory leak vulnerability exists in libcharon in strongSwan 4.1.2 through 6.0.7. The issue is caused by a missing release of memory after its effective lifetime in the IKE message parser. This vulnerability has a CVSS score of 3.7 and a CVSS severity of LOW. The vulnerability affects the IKE message parser in libcharon, which is a component of strongSwan. The memory leak could potentially lead to resource exhaustion if exploited. Defenders responsible for strongSwan deployments should assess the potential impact of this vulnerability on their systems and prioritize verification and potential remediation.

Vendor
strongSwan
Product
Unknown
CVSS
LOW 3.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-11
Advisory published
2026-09-11
Advisory updated
2026-09-11

Who should care

Defenders responsible for strongSwan deployments should assess the potential impact of this vulnerability on their systems and prioritize verification and potential remediation.

Why it matters

CVE-2026-78127 is a memory leak vulnerability in libcharon of strongSwan. Defenders should verify the presence of this vulnerability in their deployments, assess potential impact, and monitor for updates or patches.

  • Verification of strongSwan version and vulnerability presence is required.
  • Potential memory leak could lead to resource exhaustion if exploited.
  • Remediation priority is low due to CVSS severity of LOW.

Technical summary

The libcharon IKE message parser in strongSwan 4.1.2 through 6.0.7 has a memory leak due to a missing release of memory after its effective lifetime. This vulnerability is caused by a missing release of memory in the IKE message parser, which could lead to a memory leak. The affected product is strongSwan, and the vulnerability has a CVSS score of 3.7 and a CVSS severity of LOW.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their strongSwan deployments and assess the potential impact on their systems.

Recommended defensive actions

  • Verify the version of strongSwan deployed in your environment and check if it is within the affected range.
  • Assess the potential impact of this vulnerability on your systems.
  • Monitor for any updates or patches from the vendor.

Evidence notes

The CVE record and NVD vulnerability detail page provide information about this vulnerability. However, the exact versions affected and the remediation steps are not clearly stated.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-78127 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-78127

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-78127 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-78127

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.