CVE-2026-78135: Medium severity strongSwan libcharon vulnerability
Published Sep 11, 2026
·Updated
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATECHILDSA requests are mishandled, there can be an authentication bypass.
Affected Software
1 affected component
strongSwan libcharon>=5.9.7<=6.0.7
Event History
Sep 11, 2026
CVE Published
via MITRE·02:07 AM
Data Sourced
via MITRE·02:07 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
The affected component is libcharon in strongSwan versions 5.9.7 through 6.0.7. Deployments outside that stated range are not identified as affected by the provided data.
2
What level of attacker access is required?
The CVSS vector indicates the issue is remotely exploitable over the network and does not require attacker privileges or user interaction. Exploitation has high attack complexity.
3
What is the potential security impact?
Successful exploitation can bypass authentication in the IKEv2 workflow. The provided CVSS assessment rates confidentiality, integrity, and availability impact as low.