CVE-2026-78131 strongSwan CVE debrief

Who should care

Defenders responsible for strongSwan deployments, particularly those using versions 4.2.0 through 6.0.7, should assess their exposure to this vulnerability and prioritize verification and potential remediation.

Why it matters

CVE-2026-78131 is a memory leak vulnerability in the x509 plugin of strongSwan, a popular open-source VPN solution. The vulnerability has a CVSS score of 3.7 and is classified as LOW severity. Defenders should prioritize verifying the presence of this vulnerability in their strongSwan deployments and assess the potential impact on their systems. The vulnerability could potentially lead to a denial-of-service (DoS) if exploited. Evidence is limited, and further verification is required to determine the full scope of affected versions and potential exploitation.

• Potential denial-of-service (DoS) due to memory exhaustion.
• Need to verify strongSwan version and configuration to assess exposure.
• Possible impact on system performance and stability if exploited.

Technical summary

The x509 plugin in strongSwan versions 4.2.0 through 6.0.7 has a memory leak due to a missing release of memory after its effective lifetime in the attribute certificate parser. This could potentially lead to a denial-of-service (DoS) if an attacker can trigger the parsing of a specially crafted attribute certificate.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their strongSwan deployments and assess the potential impact on their systems.

Recommended defensive actions

• Verify the version of strongSwan in use and check if it is within the affected range.
• Review system configurations and assess potential exposure to this vulnerability.
• Monitor system performance and memory usage for potential signs of exploitation.

Evidence notes

The CVE record and NVD entry provide information about the vulnerability, but details about exploitation or affected versions are limited. The vulnerability has a CVSS score of 3.7 and is classified as LOW severity. Evidence is limited to the information provided in the CVE record and NVD entry. Further verification is required to determine the full scope of affected versions and potential exploitation. Defenders should verify the version of strongSwan in use, review system 4

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.