CVE-2026-78133 strongSwan CVE debrief

Who should care

Network administrators and security teams responsible for strongSwan deployments, particularly those using IKEv2, should assess exposure and apply necessary patches or mitigations.

Why it matters

CVE-2026-78133 is a high-severity vulnerability in strongSwan's libcharon, affecting versions 6.0.0-6.0.7. It requires immediate attention from network administrators and security teams to verify exposure and apply patches.

• Potential remote code execution or denial of service.
• Possible disruption of VPN services.
• Need for verification of affected versions in inventory.
• Priority for patching or upgrading to version 6.1.0.

Technical summary

The libcharon component in strongSwan versions 6.0.0 through 6.0.7 contains a use-after-free vulnerability that can occur during IKEv2 rekeying collision handling. This issue has been fixed in version 6.1.0. The vulnerability is a high-severity issue that requires immediate attention from network administrators and security teams to verify exposure and apply patches or mitigations. The technical details of the vulnerability are based on official CVE Program records and NIST NVD detail pages.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for strongSwan versions 6.0.0 through 6.0.7.

Recommended defensive actions

• Verify if strongSwan versions 6.0.0 through 6.0.7 are in use and apply patches or upgrades to version 6.1.0 or later.
• Review IKEv2 rekeying configurations and consider implementing additional security measures.
• Monitor for potential exploitation attempts and update intrusion detection systems.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected versions. The vulnerability has been confirmed in strongSwan versions 6.0.0 through 6.0.7, and defenders should verify exposure and apply patches or upgrades to version 6.1.0 or later. The evidence is based on official CVE Program records and NIST NVD detail pages, which provide source-provided CVE metadata and source-specific vulnerability assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.