CVE-2026-78126: Null Pointer Dereference

Q: Which deployments are affected?

strongSwan versions 4.1.10 through 6.0.7 are affected when the eap-aka plugin is present and reachable. The issue can cause a denial of service through a NULL pointer dereference.

Q: What does an attacker need to exploit this issue?

The vector is network-based and requires no privileges or user interaction. Exploitation has high attack complexity according to the provided CVSS vector.

Q: Is a fix available?

The referenced strongSwan 6.1.0 release is available. Versions through 6.0.7 are listed as affected.

Published Sep 11, 2026

Updated

Last updated 21 September 2026

Other sources

strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.

— MITRE

Affected Software

6 affected componentsFixes available

strongSwan Strongswan>=4.1.10<=6.0.7

strongSwan Strongswan>=4.1.10<6.1.0

debian/strongswan<5.9.8-5+deb12u6

5.9.8-5+deb12u6

debian/strongswan<6.0.1-6+deb13u7

6.0.1-6+deb13u7

debian/strongswan<6.1.0-1

6.1.0-1

debian/strongswan<=5.9.8-5+deb12u5, <=6.0.1-6+deb13u6

5.9.8-5+deb12u66.0.1-6+deb13u76.1.0-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 5.9.8-5+deb12u6
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 6.0.1-6+deb13u7
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 6.1.0-1
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 5.9.8-5+deb12u6Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2

Event History

Sep 11, 2026

CVE Published

via MITRE·01:33 AM

Data Sourced

via MITRE·01:33 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 AM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·02:18 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6487

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4879-1

Frequently Asked Questions

Which deployments are affected?

strongSwan versions 4.1.10 through 6.0.7 are affected when the eap-aka plugin is present and reachable. The issue can cause a denial of service through a NULL pointer dereference.

What does an attacker need to exploit this issue?

The vector is network-based and requires no privileges or user interaction. Exploitation has high attack complexity according to the provided CVSS vector.

Is a fix available?

The referenced strongSwan 6.1.0 release is available. Versions through 6.0.7 are listed as affected.

CVE-2026-78126: Null Pointer Dereference

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Is a fix available?

Company

Resources

Contact