CVE-2026-78129: Medium severity strongSwan Strongswan vulnerability

Q: Does exploitation require authentication or user interaction?

No privileges or user interaction are required according to the CVSS vector. The attack vector is network-based.

Q: What is the expected security impact if exploitation succeeds?

The reported impact is limited to availability, rated High. No confidentiality or integrity impact is reported.

Q: How difficult is exploitation expected to be?

The attack complexity is rated High, indicating exploitation requires conditions beyond simply reaching a vulnerable network service.

Published Sep 11, 2026

Updated

Last updated 21 September 2026

Other sources

strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.

— MITRE

Affected Software

7 affected componentsFixes available

strongSwan Strongswan>=4.6.2<=6.0.7

strongSwan Strongswan>=4.6.2<6.1.0

Microsoft azl3 strongswan 5.9.14-10<5.9.14-11

5.9.14-11

debian/strongswan<5.9.8-5+deb12u6

5.9.8-5+deb12u6

debian/strongswan<6.0.1-6+deb13u7

6.0.1-6+deb13u7

debian/strongswan<6.1.0-1

6.1.0-1

debian/strongswan<=5.9.8-5+deb12u5, <=6.0.1-6+deb13u6

5.9.8-5+deb12u66.0.1-6+deb13u76.1.0-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.9.14-11
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 5.9.8-5+deb12u6
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 6.0.1-6+deb13u7
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 6.1.0-1
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 5.9.8-5+deb12u6Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2

Event History

Sep 11, 2026

CVE Published

via MITRE·01:40 AM

Data Sourced

via MITRE·01:40 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 AM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·02:18 AM

DescriptionSeverityAffected Software

Sep 12, 2026

Data Sourced

via Microsoft·08:01 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6487

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4879-1

Frequently Asked Questions

Does exploitation require authentication or user interaction?

No privileges or user interaction are required according to the CVSS vector. The attack vector is network-based.

What is the expected security impact if exploitation succeeds?

The reported impact is limited to availability, rated High. No confidentiality or integrity impact is reported.

How difficult is exploitation expected to be?

The attack complexity is rated High, indicating exploitation requires conditions beyond simply reaching a vulnerable network service.

CVE-2026-78129: Medium severity strongSwan Strongswan vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the expected security impact if exploitation succeeds?

How difficult is exploitation expected to be?

Company

Resources

Contact