CVE-2026-78132

Infinite Loop in StrongSwan X.509 Attribute Certificate Parser

Published Sep 11, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.

Analysis

Technical impact

The vulnerability is an infinite loop triggered by the x509 plugin’s attribute certificate parser when processing ietfAttrSyntax certificates. The loop consumes CPU resources and can cause a denial of service by blocking normal operation of the strongSwan process. It maps to the weakness CWE-835, which indicates an unchecked loop or recursion that can lead to resource exhaustion.

Affected Systems

StrongSwan implementations from version 5.1.3 through 6.0.7 are affected. Any deployment of these versions that processes X.509 attribute certificates is vulnerable.

Risk and Exploitability

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV at this time. The likely attack vector is that an attacker supplies a crafted attribute certificate to a strongSwan instance, causing the infinite loop; it is inferred that this can be remotely triggered through certificate exchange procedures.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

strongSwan

unaffected

Version	Status	Constraints
`5.1.3`	affected	< 6.1.0

Configuration 1 [-]

cpe:2.3:a:strongswan:strongswan:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Strongswan

Version	Status	Scheme	Platform
`[5.1.3,6.1.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade strongSwan to version 6.1.0 or later, which resolves the infinite loop in the x509 attribute certificate parser.
If an upgrade is not immediately possible, disable the use of X.509 attribute certificates or restrict the trust anchor to trusted certificates only to reduce the attack surface.
Monitor resource usage for abnormal CPU spikes and implement appropriate rate limits or resource quotas to mitigate potential denial of service.

Generated by OpenCVE AI on September 11, 2026 at 04:43 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4879-1	strongswan security update
Debian DSA	DSA-6487-1	strongswan security update
Ubuntu USN	USN-8789-1	strongSwan vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.346% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/strongswan/strongswan/releases/tag/6.1.0
https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78132).html

History

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 5:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		Infinite Loop in StrongSwan X.509 Attribute Certificate Parser

Sep 11, 2026 2:00 AM Description updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.
First Time appeared		Strongswan Strongswan strongswan
Weaknesses		CWE-835
CPEs		cpe:2.3:a:strongswan:strongswan::::::::
Vendors & Products		Strongswan Strongswan strongswan
References		https://github.com/strongswan/strongswan/releases/tag/6.1.0 https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78132).html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`