CVE-2026-78124
Received Received - Intake

Memory Leak in strongSwan PKCS#7 Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-78124
EUVD
EUVD-2026-75899

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
strongswan strongswan From 5.0.2 (inc) to 6.0.7 (inc)
strongswan strongswan 6.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in strongSwan versions 5.0.2 through 6.0.7 involves a memory leak in the openssl plugin when processing PKCS#7 certificates. The plugin fails to release memory after enumerating certificates, causing leaks for each certificate processed.

Detection Guidance

To detect this vulnerability, monitor memory usage on systems running strongSwan versions 5.0.2 through 6.0.7 with the openssl plugin enabled. Check for unusual memory growth when processing PKCS#7 certificates. Use tools like 'top' or 'htop' to observe memory consumption over time. If memory usage increases significantly during certificate processing, the system may be affected.

Impact Analysis

An attacker could exploit this by sending a malicious PKCS#7 container via IKEv1 pre-authentication, leading to memory exhaustion. While remote code execution is not possible, the vulnerability may degrade system performance or cause denial of service.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it does not involve unauthorized data access or disclosure. The issue is a memory leak in certificate processing, which could lead to resource exhaustion but does not compromise data integrity or confidentiality.

Mitigation Strategies
  • Disable IKEv1 if possible to prevent exploitation via PKCS#7 containers.
  • Avoid using the openssl plugin; switch to the pkcs7 plugin if available.
  • Ensure the pkcs7 plugin is loaded before the openssl plugin in your strongSwan configuration.
  • Upgrade to strongSwan 6.1.0 or later to apply the official patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78124. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart