CVE-2026-25075
High · 7.5CVSS
7.5
EPSS
1.1%
Published
Mar 23, 2026
CISA due date
—
The record
strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate AVP length fields before subtraction to trigger excessive memory allocation or NULL pointer dereference, crashing the charon IKE daemon.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | strongswan | 0 | 5.9.12-150600.3.11.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | strongswan | 0 | 5.9.12-150600.3.11.1 |
| openSUSE:Leap 15.6 | strongswan | 0 | 5.9.12-150600.3.11.1 |
| openSUSE:Leap 16.0 | strongswan | 0 | 6.0.4-160000.1.1 |
| openSUSE:Tumbleweed | strongswan | 0 | 6.0.5-1.1 |
Related vulnerabilities
- CVE-2025-62291 In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious… Also affects strongswan
- CVE-2025-9615 A flaw was found in NetworkManager. Also affects strongswan
- CVE-2017-11185 The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of… Also affects strongswan
- CVE-2017-9022 The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys… Also affects strongswan
- CVE-2015-8023 The server implementation of the EAP-MSCHAPv2 protocol in the eap-mschapv2 plugin in… Also affects strongswan
- CVE-2015-4171 strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when… Also affects strongswan
- CVE-2014-9221 strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of… Also affects strongswan
- CVE-2026-88833 A flaw was found in BusyBox's udhcpc DHCP client. CWE-191