Infinite Loop in strongSwan X.509 Attribute Certificate Parser

Executive Summary

CVE-2026-78132 is a denial of service vulnerability in strongSwan's x509 plugin. It occurs when parsing ietfAttrSyntax ASN.1 types in X.509 attribute certificates, specifically the group attribute. Missing CHOICE flags in parsing rules cause the parser to enter an infinite loop while skipping unmatched alternatives without consuming data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your strongSwan version is between 5.1.3 and 6.0.7. Run 'strongswan version' to verify. If the x509 plugin is loaded, inspect logs for infinite loop errors during X.509 attribute certificate parsing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service by triggering an infinite loop in the x509 plugin. Systems using strongSwan versions 5.1.3 through 6.0.7 that load the x509 plugin are affected. The impact occurs when attribute certificates are parsed during IKEv2 payload verification. Remote code execution is not possible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service (DoS) by triggering an infinite loop during X.509 attribute certificate parsing. While it does not directly expose data, prolonged DoS conditions could disrupt services handling sensitive data, potentially impacting compliance with GDPR (availability requirements) or HIPAA (operational integrity). However, no direct data breach or unauthorized access is indicated.

Useful 0 Not Useful 0

Mitigation Strategies

Update strongSwan to version 6.1.0 or later. If updating is not possible, apply the provided patch for older versions. Ensure the x509 plugin is not loaded if not required. Block or monitor IKEv2 payloads with attribute certificates if vulnerable.

Useful 0 Not Useful 0