CVE-2026-78126: Null Pointer Dereference
Published Sep 11, 2026
·Updated
Last updated 21 September 2026
Other sources
strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.
— MITRE
Affected Software
3 affected componentsFixes available
strongSwan Strongswan>=4.1.10<=6.0.7
strongSwan Strongswan>=4.1.10<6.1.0
debian/strongswan<=5.9.8-5+deb12u5, <=6.0.1-6+deb13u6
6.0.1-6+deb13u76.1.0-2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/strongswanto a version that resolves this vulnerability.Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2
Event History
Sep 11, 2026
CVE Published
via MITRE·01:33 AM
Data Sourced
via MITRE·01:33 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:18 AM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 21, 2026
Data Sourced
via Ubuntu·01:52 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·01:53 PM
Description
Data Sourced
via Debian·01:53 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which deployments are affected?
strongSwan versions 4.1.10 through 6.0.7 are affected when the eap-aka plugin is present and reachable. The issue can cause a denial of service through a NULL pointer dereference.
2
What does an attacker need to exploit this issue?
The vector is network-based and requires no privileges or user interaction. Exploitation has high attack complexity according to the provided CVSS vector.
3
Is a fix available?
The referenced strongSwan 6.1.0 release is available. Versions through 6.0.7 are listed as affected.