CVE-2026-78133
Received Received - Intake

Use-After-Free in strongSwan IKEv2 Rekeying

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-78133
EUVD
EUVD-2026-75907

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
strongswan strongswan From 6.0.0 (inc) to 6.0.7 (inc)
strongswan strongswan 6.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78133 is a use-after-free vulnerability in strongSwan's libcharon library affecting versions 6.0.0 through 6.0.7. It occurs during IKEv2 rekeying collisions when multiple key exchanges happen simultaneously. The active rekeying task keeps a reference to a passive task that fails or delays, creating a dangling pointer. This can lead to crashes or remote code execution by authenticated peers.

Detection Guidance

Detecting CVE-2026-78133 requires checking the strongSwan version and monitoring for IKEv2 rekeying collisions. Use 'strongswan version' to verify if your system is running a vulnerable version (6.0.0-6.0.7). Inspect logs for IKEv2 rekeying failures or crashes in libcharon. Enable debug logging with 'charondebug=ike 2' in strongswan.conf to capture detailed rekeying events.

Impact Analysis

If exploited, this vulnerability could allow an authenticated attacker to execute arbitrary code remotely on a vulnerable strongSwan server. This may lead to unauthorized access, data breaches, or denial-of-service conditions. Servers not accepting multiple key exchanges are not affected.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling remote code execution through authenticated peers. A use-after-free flaw may lead to unauthorized access, data breaches, or system compromise, violating confidentiality and integrity requirements in these regulations.

Mitigation Strategies

Upgrade strongSwan to version 6.1.0 or later immediately. If upgrading is not possible, apply patches provided for older releases. Disable IKEv2 rekeying if not critical by setting 'rekey=no' in strongswan.conf. Restrict authentication to trusted peers only to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78133. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart