CVE-2026-78129: Medium severity strongSwan Strongswan vulnerability
Published Sep 11, 2026
·Updated
Last updated 21 September 2026
Other sources
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
— MITRE
Affected Software
4 affected componentsFixes available
strongSwan Strongswan>=4.6.2<=6.0.7
strongSwan Strongswan>=4.6.2<6.1.0
Microsoft azl3 strongswan 5.9.14-10<5.9.14-11
5.9.14-11
debian/strongswan<=5.9.8-5+deb12u5, <=6.0.1-6+deb13u6
6.0.1-6+deb13u76.1.0-2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.9.14-11 - Upgrade
Upgrade
debian/strongswanto a version that resolves this vulnerability.Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2
Event History
Sep 11, 2026
CVE Published
via MITRE·01:40 AM
Data Sourced
via MITRE·01:40 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:18 AM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 12, 2026
Data Sourced
via Microsoft·08:01 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:01 AM
Affected Software
Updated
via Microsoft·08:01 AM
DescriptionSeverity
Sep 21, 2026
Data Sourced
via Debian·01:53 PM
DescriptionAffected Software
Data Sourced
via Launchpad·01:53 PM
Description
Sep 22, 2026
Data Sourced
via Ubuntu·01:54 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
No privileges or user interaction are required according to the CVSS vector. The attack vector is network-based.
2
What is the expected security impact if exploitation succeeds?
The reported impact is limited to availability, rated High. No confidentiality or integrity impact is reported.
3
How difficult is exploitation expected to be?
The attack complexity is rated High, indicating exploitation requires conditions beyond simply reaching a vulnerable network service.