CVE-2026-78132: High severity strongSwan Strongswan vulnerability
Published Sep 11, 2026
·Updated
Last updated 21 September 2026
Other sources
strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
— MITRE
Affected Software
4 affected componentsFixes available
strongSwan Strongswan>=5.1.3<=6.0.7
strongSwan Strongswan>=5.1.3<6.1.0
Microsoft azl3 strongswan 5.9.14-10<5.9.14-11
5.9.14-11
debian/strongswan<=5.9.8-5+deb12u5, <=6.0.1-6+deb13u6
6.0.1-6+deb13u76.1.0-2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.9.14-11 - Upgrade
Upgrade
debian/strongswanto a version that resolves this vulnerability.Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2
Event History
Sep 11, 2026
CVE Published
via MITRE·01:49 AM
Data Sourced
via MITRE·01:49 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:18 AM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 12, 2026
Data Sourced
via Microsoft·08:02 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:02 AM
Affected Software
Updated
via Microsoft·08:02 AM
DescriptionSeverity
Sep 22, 2026
Data Sourced
via Ubuntu·01:54 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·01:55 PM
DescriptionAffected Software
Data Sourced
via Launchpad·01:55 PM
Description
Frequently Asked Questions
1
What access does an attacker need to trigger the issue?
The CVSS vector indicates network access is sufficient, with low attack complexity. It does not require privileges or user interaction.
2
What is the expected security impact?
The issue can cause an infinite loop, resulting in a denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact, but a high availability impact.