CVE-2026-78132: High severity strongSwan Strongswan vulnerability

Q: What access does an attacker need to trigger the issue?

The CVSS vector indicates network access is sufficient, with low attack complexity. It does not require privileges or user interaction.

Q: What is the expected security impact?

The issue can cause an infinite loop, resulting in a denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact, but a high availability impact.

Published Sep 11, 2026

Updated

Last updated 21 September 2026

Other sources

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.

— MITRE

Affected Software

7 affected componentsFixes available

strongSwan Strongswan>=5.1.3<=6.0.7

strongSwan Strongswan>=5.1.3<6.1.0

Microsoft azl3 strongswan 5.9.14-10<5.9.14-11

5.9.14-11

debian/strongswan<5.9.8-5+deb12u6

5.9.8-5+deb12u6

debian/strongswan<6.0.1-6+deb13u7

6.0.1-6+deb13u7

debian/strongswan<6.1.0-1

6.1.0-1

debian/strongswan<=5.9.8-5+deb12u5, <=6.0.1-6+deb13u6

5.9.8-5+deb12u66.0.1-6+deb13u76.1.0-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.9.14-11
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 5.9.8-5+deb12u6
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 6.0.1-6+deb13u7
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 6.1.0-1
Upgrade
Upgrade debian/strongswan to a version that resolves this vulnerability.
Fixed in 5.9.8-5+deb12u6Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2

Event History

Sep 11, 2026

CVE Published

via MITRE·01:49 AM

Data Sourced

via MITRE·01:49 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 AM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·02:18 AM

DescriptionSeverityAffected Software

Sep 12, 2026

Data Sourced

via Microsoft·08:02 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6487

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4879-1

Frequently Asked Questions

What access does an attacker need to trigger the issue?

The CVSS vector indicates network access is sufficient, with low attack complexity. It does not require privileges or user interaction.

What is the expected security impact?

The issue can cause an infinite loop, resulting in a denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact, but a high availability impact.

CVE-2026-78132: High severity strongSwan Strongswan vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What access does an attacker need to trigger the issue?

What is the expected security impact?

Company

Resources

Contact