CVE-2026-78124

StrongSwan PKCS#7 Certificate Enumeration Memory Leak

Published Sep 11, 2026 CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Description

strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.

Analysis

Technical impact

strongSwan versions 5.0.2 through 6.0.7 contain a flaw in the OpenSSL plugin that permits PKCS#7 certificate enumeration. The routine fails to release memory after the objects’ effective lifetime, creating a memory leak (CWE‑401). Although each individual leak may be small, repeated use over time can exhaust system memory and cause a denial‑of‑service condition for the strongSwan process.

Affected Systems

The vulnerability affects the strongSwan vendor’s open‑source VPN software, specifically all releases between 5.0.2 and 6.0.7 inclusive. Clients running these versions on any platform that uses the OpenSSL plugin are at risk.

Risk and Exploitability

The CVSS score of 3.7 indicates low severity, and no EPSS value is available, so the likelihood of exploitation is unknown. This vulnerability is not listed in CISA’s KE vector could be remote if an adversary can force the strongSwan server to enumerate certificates, but the precise vector is not explicitly stated in the advisory; it is inferred that remote access to the OpenSSL plugin is required.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

strongSwan

unaffected

Version	Status	Constraints
`5.0.2`	affected	< 6.1.0

Configuration 1 [-]

cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Strongswan

Version	Status	Scheme	Platform
`[5.0.2,6.1.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade strongSwan to version 6.1.0 or newer to fix the memory release bug.
Disable the vulnerable OpenSSL plugin or block certificate enumeration when unnecessary to reduce exposure.
Monitor system memory usage and logs for leaks, and configure an alert if memory consumption grows beyond normal thresholds.

Generated by OpenCVE AI on September 11, 2026 at 03:48 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4879-1	strongswan security update
Debian DSA	DSA-6487-1	strongswan security update
Ubuntu USN	USN-8789-1	strongSwan vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.254% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/strongswan/strongswan/releases/tag/6.1.0
https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78124).html

History

Sep 12, 2026 11:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 4:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		StrongSwan PKCS#7 Certificate Enumeration Memory Leak

Sep 11, 2026 1:45 AM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime.
First Time appeared		Strongswan Strongswan strongswan
Weaknesses		CWE-401
CPEs		cpe:2.3:a:strongswan:strongswan::::::::
Vendors & Products		Strongswan Strongswan strongswan
References		https://github.com/strongswan/strongswan/releases/tag/6.1.0 https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78124).html
Metrics		cvssV3_1 `{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}`