algo

Algo VPN Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release announcement for more information. Features Supports only IKEv2 with strong crypto AES-GCM...

strongswan

strongSwan Configuration Overview strongSwan is an OpenSource IPsec-based VPN solution. This document is just a short introduction of the strongSwan swanctl command which uses the modern vici Versatile IKE Configuration Interface. The deprecated ipsec command using the legacy stroke configuration...

CVE-2026-129102

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to a command injection flaw in the vpn.set_conf RPC method. Authenticated administrators can exploit this by injecting newlines into the IPsec keyexchange field to append a second leftupdown directive to ipsec.conf. This allows for the execu...

EUVD-2026-125447

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.setconf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which...

CVE-2026-25075-check

CVE-2026-25075 Vulnerability Assessment Tool Safely detect whether a strongSwan VPN server is vulnerable to CVE-2026-25075 without causing any disruption. See the full write-up at the Bishop Fox blog. Description CVE-2026-25075 is an integer underflow vulnerability in strongSwan's EAP-TTLS plugin...

CVE-2026-35330

CVE-2026-35330 strongSwan EAP-SIM / EAP-AKA attribute parser pre-auth heap buffer overflow via integer underflow. Description parseattributes in src/libsimaka/simakamessage.c:419 reads TLV headers whose length byte counts 4-byte words. For the ATRAND / ATENCRDATA branch: if hdr-length 4 in.len ||...

CVE-2026-35333

CVE-2026-35333 strongSwan RADIUS attribute-iterator pre-auth infinite loop / remote DoS. Description attributeenumerate in src/libradius/radiusmessage.c:247-271 accepts RADIUS attributes whose length byte is smaller than sizeofrattrt 2. For length == 0: data-len = next-length - sizeofrattrt...

kernel: xfrm: Duplicate SPI Handling

A flaw was found in the Linux kernel's XFRM subsystem, which handles Internet Protocol Security IPsec traffic. When assigning a Security Parameter Index SPI—a unique identifier used to manage encrypted network tunnels—the kernel fails to ensure that the identifier is globally unique across...

[SECURITY] [DLA 4879-1] strongswan security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4879-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley November 02, 2026 https://wiki.debian.org/LTS -...

Photon OS 5.0: Strongswan PHSA-2023-5.0-90-0010

An update of the strongswan package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-90-0010. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Debian dla-4879 : charon-cmd - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4879 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4879-1 [email protected]...

Photon OS 5.0: Strongswan PHSA-2023-5.0-90-0159

An update of the strongswan package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-90-0159. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CLEANSTART-2024-CF23722 In stroke_socket

Security vulnerability affects the strongswan package. In strokesocket...

CLEANSTART-2024-YN32436 In verify_emsa_pkcs1_signature() in gmp_rsa_public_key

Security vulnerability affects the strongswan package. In verifyemsapkcs1signature in gmprsapublickey...

CLEANSTART-2024-YE82665 In verify_emsa_pkcs1_signature() in gmp_rsa_public_key

Security vulnerability affects the strongswan package. In verifyemsapkcs1signature in gmprsapublickey...

CLEANSTART-2024-BI55695 In strongSwan before 5

Security vulnerability affects the strongswan package. In strongSwan before 5...

CLEANSTART-2024-UX09598 strongSwan before 5

Security vulnerability affects the strongswan package. strongSwan before 5...

Astra Linux – vulnerability in strongswan

StrongSwan versions 4.5.0 up to and including 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser. This vulnerability allows unauthenticated remote attackers to cause a denial of service by sending specially crafted AVP data containing invalid length fields during IKEv2...

Astra Linux – vulnerability in strongswan

In StrongSwan versions prior to 6.0.7, identity parsing/cloning is handled incorrectly. Parsed EAP-Identities that result in an empty but non-NULL encoding are not properly cloned; this leads to a double-free condition once the duplicates are destroyed...

Security update for strongswan (important)

openSUSE security update: security update for strongswan ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22050-1 Rating: important References: bsc1276533 bsc1276534 bsc1276536 bsc1276539 bsc1276540 bsc1276541 bsc1276543 bsc1276544 bsc1276545...