An integer underflow bug in the EAP‑TTLS AVP parser in strongSwan versions 4.5.0 to 6.0.4 allows attackers to send crafted AVP data with invalid length fields during IKEv2 authentication. The failure to validate AVP lengths before subtraction can lead to excessive memory allocation or a null pointer dereference, crashing the charon IKE daemon and resulting in a denial of service. The vulnerability is classified with a CVSS score of 8.7, indicating high severity.

The flaw affects all strongSwan releases prior to 6.0.5, including versions 4.5.0 through 6.0.4. Only installations running these versions are impacted; versions 6.0.5 and later contain the fix.

The vulnerability is exploitable remotely by any unauthenticated actor who can connect to the IKEv2 service. Attackers must send specifically crafted EAP‑TTLS AVP packets with invalid length fields. No EPSS score is publicly available, and the defect is not listed in the CISA Known Exploited Vulnerabilities catalog, but the CVSS score signals a serious risk if exploited. The lack of a publicly known exploit does not reduce the urgency for patching, as the attack path is straightforward and requires no special credentials.