These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in libcharon in strongSwan 5.9.7 through 6.0.7 can lead to authentication bypass due to mishandling of CREATE_CHILD_SA requests in the IKEv2 state machine. This issue affects strongSwan deployments, potentially impacting confidentiality and integrity. Defenders should assess exposure and prioritize patching or mitigation. The vulnerability has a medium severity and is being actively monito [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-11T02:18:34.910Z and has not been modified since then. The vulnerability affects strongSwan 4.5.0 through 6.0.7, with Incorrect Access Control in the eap-ttls and eap-peap plugins due to missing or mismatched inner EAP identity. Network administrators and security teams should assess exposure and pr [truncated]
A use-after-free vulnerability exists in libcharon of strongSwan versions 6.0.0 through 6.0.7, which can be triggered during IKEv2 rekeying collision handling. This issue has been addressed in version 6.1.0. The vulnerability affects the libcharon component and requires immediate attention from network administrators and security teams to verify exposure and apply patches or mitigations. The issue is a hi [truncated]
CVE-2026-78132 is a HIGH severity vulnerability in strongSwan versions 5.1.3 through 6.0.7, caused by an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax. This issue has a CVSS score of 7.5 and can lead to a denial of service. The CVE record was published on 2026-09-11T02:18:34.613Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.
A memory leak vulnerability exists in strongSwan versions 4.2.0 through 6.0.7 in the x509 plugin's attribute certificate parser. This issue could potentially lead to a denial-of-service (DoS) if exploited. The vulnerability has a CVSS score of 3.7 and is classified as LOW severity. The vulnerability is caused by a missing release of memory after its effective lifetime in the attribute certificate parser. [truncated]
A NULL pointer dereference vulnerability exists in the x509 plugin's attribute certificate parser of strongSwan versions 4.2.0 through 6.0.7. This issue could potentially lead to a denial-of-service (DoS) condition if exploited. The vulnerability is considered high-severity, with a CVSS score of 7.5, and defenders should assess exposure and prioritize mitigation or patching. The CVE record and NVD entry p [truncated]
A vulnerability in strongSwan versions 4.6.2 through 6.0.7 allows for an infinite loop in PKCS#5 decryption, potentially leading to a denial-of-service (DoS) attack. The CVE record was published on 2026-09-11T02:18:34.207Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. This issue affects strongSwan installations, which defenders should assess for potential exposure a [truncated]
A memory leak vulnerability exists in libcharon in strongSwan 4.1.2 through 6.0.7. The issue is caused by a missing release of memory after its effective lifetime in the IKE message parser. This vulnerability has a CVSS score of 3.7 and a CVSS severity of LOW. The vulnerability affects the IKE message parser in libcharon, which is a component of strongSwan. The memory leak could potentially lead to resour [truncated]
A NULL pointer dereference vulnerability exists in the eap-aka plugin of strongSwan versions 4.1.10 through 6.0.7. This issue may lead to a denial-of-service condition. The vulnerability is located in the eap-aka plugin, which is a part of the strongSwan software. The affected versions are 4.1.10 through 6.0.7. The vulnerability could allow an attacker to cause a denial-of-service condition. The CVE recor [truncated]
A vulnerability in strongSwan 5.0.2 through 6.0.7 allows for PKCS#7 certificate enumeration in the openssl plugin, leading to a lack of release of memory after its effective lifetime. This issue has been addressed in version 6.1.0. Defenders should assess exposure and prioritize patching to version 6.1.0. The vulnerability affects systems using strongSwan for VPN or other cryptographic operations, potenti [truncated]
A vulnerability in strongSwan versions 5.0.2 through 6.0.7 allows for an expired pointer dereference in PKCS#7 parsing within the openssl plugin, potentially leading to a denial of service. This medium-severity issue, with a CVSS score of 5.9, was publicly disclosed on September 11, 2026. The vulnerability affects strongSwan IKE daemon deployments using the openssl plugin. Verification of strongSwan versi [truncated]
A double-free vulnerability exists in strongSwan before version 6.0.7 due to mishandled identity parsing and cloning. Specifically, parsed EAP-Identities resulting in an empty but non-NULL encoding are not correctly cloned, leading to a double-free when duplicates are destroyed. This vulnerability can lead to potential denial of service and remote code execution if exploited. Defenders should verify expos [truncated]
A vulnerability was found in strongSwan versions 4.5.0 prior to 6.0.5. This issue is an integer underflow in the EAP-TTLS AVP parser, which allows unauthenticated remote attackers to cause a denial of service. The vulnerability is triggered by sending crafted AVP data with invalid length fields during IKEv2 authentication. Unaffected versions have addressed this vulnerability. Users should review their de [truncated]
