Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : strongSwan vulnerabilities (USN-8789-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8789-1 advisory. It was discovered that strongSwan incorrectly handled PKCS7 containers in the openssl plugin. A remote attacker could possibly us...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

DEBIAN-CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

AZL-100043 CVE-2026-78126 affecting package strongswan for versions less than 5.9.14-11

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-78126

CVE-2026-78126 affects strongSwan (an IKE/IPsec suite), versions 4.1.10 through 6.0.7 . The vulnerability is a NULL-pointer dereference in the eap-aka plugin triggered when processing an unexpected AKA-Synchronization-Failure message, which can result in a crash (denial of service). The CVSS 3.1 ...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

EUVD-2026-75900

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

CVE-2026-78126: NULL Pointer Dereference

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

SUSE CVE-2026-78126

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin...

PT-2026-89674

Name of the Vulnerable Software and Affected Versions strongSwan versions 4.1.10 through 6.0.7 Description A NULL pointer dereference occurs in the eap-aka plugin. A NULL pointer dereference is a condition where a program attempts to read or write to a memory address that is NULL, typically leadi...

Debian dsa-6487 : charon-cmd - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6487 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6487-1 [email protected] https://www.debian.org/securit...

GHSA-FP46-6VFW-GC9C free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions. Two authentication flows are affected in internal/sbi/processor/ueauthentication.go: 1. 5G-AKA confirmation compares RES and...

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

Exploit for CVE-2026-35330

CVE-2026-35330 strongSwan EAP-SIM / EAP-AKA attribute parser...

Fedora 36 : freeradius (2022-98832b2cc2)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-98832b2cc2 advisory. Update to upstream release 3.0.26. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...