NULL Pointer Dereference in strongSwan eap-aka Plugin

Executive Summary

CVE-2026-78126 is a vulnerability in strongSwan's eap-aka plugin where improper handling of an AKA-Synchronization-Failure message causes a null-pointer dereference, leading to a crash. It affects versions 4.1.10 through 6.0.7.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the strongSwan service is running and if the eap-aka plugin is enabled. Inspect logs for crashes or null-pointer dereference errors related to EAP-AKA processing. No specific commands are provided in the resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can disrupt service by crashing the strongSwan instance. It does not allow remote code execution but may cause denial-of-service conditions. Systems using the eap-aka plugin are particularly affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service by crashing the strongSwan VPN service due to a null-pointer dereference in the eap-aka plugin. While it does not enable remote code execution, service disruption could impact availability of systems handling sensitive data. For GDPR, this may affect the integrity and availability of personal data processing systems. For HIPAA, it could disrupt secure communications of protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

• Disable the EAP-AKA plugin if not required.
• Disable the request_identity option in strongSwan configuration.
• Use a RADIUS server for EAP authentication.
• Upgrade to strongSwan 6.1.0 or apply patches for versions 4.4.0 and later.

Useful 0 Not Useful 0