CVE-2026-78130

CVE-2026-78130 is a NULL pointer dereference (CWE-476) in the attribute certificate parser of strongSwan's x509 plugin, the component responsible for parsing X.509 certificates and attribute certificates in the IKE daemon. A remote, unauthenticated attacker can trigger the flaw by getting a vulnerable strongSwan instance to parse crafted certificate data, most plausibly an attribute certificate supplied by a peer during IKE negotiation, with no privileges or user interaction required. The outcome is a crash of the VPN daemon and therefore denial of service, since the CVSS vector scores availability impact only (C:N/I:N/A:H), with no indication of code execution or data compromise. Any deployment running strongSwan 4.2.0 through 6.0.7 that uses the x509 plugin (the default certificate-handling plugin in typical builds) is affected, covering a very wide range of releases. The issue is not in CISA's KEV, no public proof-of-concept is known, and no in-the-wild exploitation has been reported.

What to do: Upgrade strongSwan to a patched release newer than 6.0.7 as soon as the project publishes a fixed version (check the strongSwan security advisory for the exact fixed release number, since none is stated here). Until patching, restrict reachability of the IKE services (UDP 500 and 4500) to trusted peers, since exploitation requires unauthenticated network access to the daemon. Verify installed versions (ipsec --version or your package manager) and watch for repeated IKE daemon crashes on exposed gateways as an early indicator of exploitation.