CVE-2026-78129
Received Received - Intake

Infinite Loop in strongSwan PKCS#5 Decryption

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-78129
EUVD
EUVD-2026-75902

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
strongswan strongswan From 4.6.2 (inc) to 6.0.7 (inc)
strongswan strongswan 6.1.0
strongswan libstrongswan *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an infinite loop in strongSwan versions 4.6.2 through 6.0.7 during PKCS#5 decryption. It occurs due to improper validation of PKCS#5 parameters in encrypted PKCS#7 containers, causing processing threads to hang indefinitely or crash from excessive stack allocation.

Detection Guidance

Detecting this vulnerability requires checking for strongSwan versions between 4.6.2 and 6.0.7. Run 'strongswan version' to verify the installed version. Monitor logs for IKEv1 certificate payload processing delays or crashes. Check for excessive CPU usage in strongSwan processes, which may indicate the infinite loop.

Impact Analysis

The vulnerability can cause denial of service by making strongSwan processing threads hang or crash. It may disrupt VPN services relying on strongSwan for IKEv1 certificate payloads, leading to service unavailability.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to denial of service conditions. GDPR requires maintaining system availability, while HIPAA mandates reliable access to protected health information. The infinite loop in PKCS#5 decryption may lead to prolonged downtime, potentially violating these requirements.

Mitigation Strategies

Upgrade to strongSwan 6.1.0 or later. If upgrading is not possible, disable the pkcs7 plugin by adding 'pkcs7 {}' to strongswan.conf. For versions 5.1.0 and later, apply available patches. Ensure IKEv1 certificate payloads are not processed from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart