REDHAT-BUG-2550254: High severity strongSwan Strongswan vulnerability

Q: Which deployments are exposed?

Only strongSwan configurations with IKE over TCP enabled using listen-tcp=yes are affected. IKE over TCP is not enabled by default.

Q: Does an attacker need to authenticate first?

No. The crash can occur before the remote peer has authenticated itself.

Q: What is the practical impact of repeated exploitation?

Repeated triggering can cause a denial of service by crashing the daemon. Remote code execution could also be possible.

Q: What can be done if an update cannot be applied immediately?

Disable IKE over TCP by ensuring listen-tcp=yes is not present in the configuration, where operationally feasible.

Q: Which versions are identified as vulnerable or fixed?

Versions 4.0 through 5.4, inclusive, are identified as vulnerable. Versions 5.4.1 and 5.3.3 are identified as not vulnerable.

Published Oct 13, 2026

Updated

IKE state is retained in memory after the client closes the connection storing a pointer to ifaceendpoint inside ikesa.sa->stifaceendpoint. Once this invalid pointer is used, the daemon crashes. This can happen before the remote peer has authenticated itself. The option for IKE over TCP is not enabled by default. Only configurations that contain listen-tcp=yes are affected. Continued triggering of this vulnerability can lead to a denial of service. Remote code execution could be possible.

Vulnerable versions : 4.0 up to and including 5.4 Not vulnerable : 5.4.1 and 5.3.3

Affected Software

1 affected component

strongSwan Strongswan>=4.0<=5.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.4.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.3.3

Event History

Oct 13, 2026

Data Sourced

via Red Hat·07:50 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Only strongSwan configurations with IKE over TCP enabled using listen-tcp=yes are affected. IKE over TCP is not enabled by default.

Does an attacker need to authenticate first?

No. The crash can occur before the remote peer has authenticated itself.

What is the practical impact of repeated exploitation?

Repeated triggering can cause a denial of service by crashing the daemon. Remote code execution could also be possible.

What can be done if an update cannot be applied immediately?

Disable IKE over TCP by ensuring listen-tcp=yes is not present in the configuration, where operationally feasible.

Which versions are identified as vulnerable or fixed?

Versions 4.0 through 5.4, inclusive, are identified as vulnerable. Versions 5.4.1 and 5.3.3 are identified as not vulnerable.

REDHAT-BUG-2550254: High severity strongSwan Strongswan vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need to authenticate first?

What is the practical impact of repeated exploitation?

What can be done if an update cannot be applied immediately?

Which versions are identified as vulnerable or fixed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does an attacker need to authenticate first?

What is the practical impact of repeated exploitation?

What can be done if an update cannot be applied immediately?

Which versions are identified as vulnerable or fixed?