Priority LOW 32
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00424 · Published 2026-09-11 · Fixed in 6.1.0 CWE-841
Priority LOW 34
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00451 · Published 2026-09-11 · Fixed in 6.1.0 CWE-863
Priority LOW 35
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00466 · Published 2026-09-11 · Fixed in 6.1.0 CWE-416
Priority LOW 39
strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00346 · Published 2026-09-11 · Fixed in 6.1.0 CWE-835
Priority LOW 17
strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00275 · Published 2026-09-11 · Fixed in 6.1.0 CWE-401
Priority LOW 39
strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00346 · Published 2026-09-11 · Fixed in 6.1.0 CWE-476
Priority LOW 27
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00463 · Published 2026-09-11 · Fixed in 6.1.0 CWE-835
Priority LOW 18
libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.0041 · Published 2026-09-11 · Fixed in 6.1.0 CWE-401
Priority LOW 27
strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-09-11 · Fixed in 6.1.0 CWE-476
Priority LOW 17
strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00254 · Published 2026-09-11 · Fixed in 6.1.0 CWE-401
Priority LOW 27
strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00463 · Published 2026-09-11 · Fixed in 6.1.0 CWE-825
THREATIST.IORead the docs