CVE-2026-78130: Null Pointer Dereference
Last updated 21 September 2026
Other sources
strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.9.14-11 - Upgrade
Upgrade
debian/strongswanto a version that resolves this vulnerability.Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2
Event History
Frequently Asked Questions
Which deployments are affected?
strongSwan versions 4.2.0 through 6.0.7 are affected. The issue is in the x509 plugin's attribute certificate parser.
What access does an attacker need to trigger the issue?
The supplied vector indicates network-reachable exploitation with low attack complexity, requiring no privileges or user interaction.
What is the likely impact of successful exploitation?
Successful exploitation can cause a denial of service through a NULL pointer dereference. The supplied impact vector indicates no confidentiality or integrity impact.
What fixed version is available?
The provided release reference identifies strongSwan 6.1.0 as the release containing the fix.