CVE-2026-78124: Low severity strongSwan Strongswan vulnerability
Last updated 21 September 2026
Other sources
strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.9.14-11 - Upgrade
Upgrade
debian/strongswanto a version that resolves this vulnerability.Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2 - Upgrade
Upgrade
strongSwanto a version that resolves this vulnerability.Fixed in 6.0.7 - Compensating control
Mitigate the issue by disabling or avoiding the strongSwan openssl plugin that allows PKCS#7 certificate enumeration, until the affected strongSwan version is patched/upgraded.
Event History
Frequently Asked Questions
What access does an attacker need to attempt exploitation?
The vector is network-based, and no privileges or user interaction are required. Exploitation has high attack complexity.
What is the expected security impact?
The reported impact is limited to confidentiality. No integrity or availability impact is indicated.
Which deployments should be reviewed first?
Review strongSwan installations running versions 5.0.2 through 6.0.7, particularly where the openssl plugin is used for PKCS#7 certificate handling.