CVE-2026-78135

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATECHILDSA requests are mishandled, there can be an authentication bypass...

CVE-2026-78133

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling...

CVE-2026-78127

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser...

CVE-2026-78135

libcharon in strongSwan (versions 5.9.7 through 6.0.7) mishandles CREATE_CHILD_SA requests on unestablished IKE SAs within the IKEv2 state machine, allowing the creation of a usable Child SA before authentication completes (authentication bypass). The vulnerability requires no privileges but has ...

EUVD-2026-75921

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATECHILDSA requests are mishandled, there can be an authentication bypass...

CVE-2026-78133

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling...

CVE-2026-78133

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling...

CVE-2026-78133

CVE-2026-78133 is a use-after-free vulnerability in libcharon , the core component of strongSwan (versions 6.0.0 through 6.0.7), triggered during IKEv2 rekeying collision handling . According to the Debian security advisory, this can lead to remote code execution . The CVSS 3.1 base score is 7.5 ...

EUVD-2026-75907

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling...

CVE-2026-78127

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser...

EUVD-2026-75901

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser...

CVE-2026-78127

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser...

CVE-2026-78127

CVE-2026-78127 affects libcharon in strongSwan 4.1.2 through 6.0.7 , where a memory is not released after its effective lifetime during IKE message stringification (logging). The resulting memory leak can lead to denial of service via memory exhaustion. The CVSS 3.1 base score is 3.7 (LOW) , with...

PT-2026-89675

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser...

PT-2026-89739

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling...

Debian DSA-5560-1 : strongswan - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5560 advisory. Florian Picca reported a bug in the charon-tkm daemon in strongSwan an IKE/IPsec suite. The TKM-backed version of the charon IKE daemon charon-tkm doesn't check the...