CVE-2026-78133: Use After Free
Last updated 21 September 2026
Other sources
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/strongswanto a version that resolves this vulnerability.Fixed in 5.9.8-5+deb12u5Fixed in 6.0.1-6+deb13u7Fixed in 6.1.0-2
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Deployments using strongSwan libcharon versions 6.0.0 through 6.0.7 are affected. Review systems where IKEv2 rekeying is enabled or used.
What does an attacker need to exploit this issue?
The vulnerability is network-reachable and requires low privileges. Exploitation has high attack complexity and does not require user interaction.
What is the potential impact of successful exploitation?
Successful exploitation may result in high impact to confidentiality, integrity, and availability.
How can I determine whether an installation is affected?
Check the installed strongSwan/libcharon version. Versions from 6.0.0 through 6.0.7 fall within the affected range.