CVE-2026-78131
Received Received - Intake

Memory Leak in strongSwan X.509 Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-78131
EUVD
EUVD-2026-75904

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
strongswan strongswan From 4.2.0 (inc) to 6.0.7 (inc)
strongswan strongswan 6.1.0
strongswan strongswan 5.1.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78131 is a memory leak vulnerability in strongSwan's x509 plugin. It occurs when parsing X.509 attribute certificates with multiple GeneralName entries in Holder or Issuer fields, or multiple AuthorityKeyIdentifier extensions. The parser fails to release memory after processing these entries, causing progressive memory exhaustion and potential denial of service.

Detection Guidance

Detecting this vulnerability requires checking if the x509 plugin is loaded in strongSwan and if attribute certificates are being parsed. Inspect strongSwan logs for memory exhaustion errors or unusual plugin behavior. Commands like 'ipsec statusall' can show loaded plugins, and 'journalctl -u strongswan' may reveal related errors.

Impact Analysis

This vulnerability can lead to denial of service by exhausting system memory. It affects strongSwan installations where the x509 plugin is loaded and attribute certificates are parsed during IKEv2 exchanges. Remote code execution is not possible through this vulnerability.

Compliance Impact

This vulnerability causes memory exhaustion leading to denial of service, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems. However, the provided context does not specify direct compliance impacts.

Mitigation Strategies

Immediately disable the x509 plugin by adding 'load = no' for the plugin in strongSwan's configuration file. Upgrade to strongSwan 6.1.0 or apply patches for versions 5.1.3 and newer. If upgrading is not possible, avoid using attribute certificates in IKEv2 exchanges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78131. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart