CVE-2026-78131: Low severity strongSwan Strongswan vulnerability
Last updated 21 September 2026
Other sources
strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.9.14-11 - Upgrade
Upgrade
debian/strongswanto a version that resolves this vulnerability.Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2
Event History
Frequently Asked Questions
Which deployments are affected?
strongSwan versions 4.2.0 through 6.0.7 are affected. The issue is in the x509 plugin's attribute certificate parser.
What access does an attacker need to exploit this issue?
The supplied vector indicates network reachability, no privileges, and no user interaction are required. Exploitation has high attack complexity and is limited to an availability impact.
What is the remediation version?
The provided release reference identifies strongSwan 6.1.0. Organizations running affected versions should review that release as the available update path.