CVE-2026-25075: strongSwan EAP-TTLS DOS Vulnerability

CVE-2026-25075 Overview

CVE-2026-25075 is an integer underflow vulnerability affecting strongSwan versions 4.5.0 prior to 6.0.5. The flaw exists in the EAP-TTLS AVP (Attribute-Value Pair) parser and allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. This vulnerability is classified as CWE-191 (Integer Underflow).

The vulnerability stems from a failure to properly validate AVP length fields before performing subtraction operations. Attackers can exploit this weakness to trigger excessive memory allocation or a NULL pointer dereference, ultimately crashing the charon IKE daemon and disrupting VPN services.

Critical Impact

Unauthenticated remote attackers can crash the strongSwan charon IKE daemon, causing denial of service for all VPN connections and potentially disrupting enterprise network access.

Affected Products

• strongSwan versions 4.5.0 through 6.0.4
• Systems using EAP-TTLS authentication method
• IKEv2 deployments with vulnerable charon daemon configurations

Discovery Timeline

• 2026-03-23 - CVE-2026-25075 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-25075

Vulnerability Analysis

The integer underflow vulnerability resides within the EAP-TTLS AVP parsing code in strongSwan's charon IKE daemon. During IKEv2 authentication, the EAP-TTLS protocol processes AVP data structures that contain length fields indicating the size of attribute values. The vulnerable code fails to properly validate these length fields before performing arithmetic operations.

When an attacker submits an AVP with a maliciously crafted length field that is smaller than expected header overhead, the subtraction operation results in an integer underflow. This causes the length variable to wrap around to a very large positive value, leading to one of two outcomes: either an attempt to allocate an excessive amount of memory (causing resource exhaustion), or a NULL pointer dereference when processing the malformed data structure.

The attack is particularly dangerous because it can be triggered by unauthenticated remote attackers during the initial phases of IKEv2 negotiation, before any authentication has taken place. This means any network-accessible strongSwan deployment using EAP-TTLS is potentially vulnerable.

Root Cause

The root cause of CVE-2026-25075 is improper input validation in the EAP-TTLS AVP parser. Specifically, the code performs a subtraction operation on the length field without first verifying that the length value is sufficiently large to accommodate the required header bytes. When the length field contains a value smaller than the header size, the subtraction underflows, producing an unexpectedly large unsigned integer value.

This is a classic integer underflow condition (CWE-191) where insufficient bounds checking before arithmetic operations leads to exploitable behavior. The fix involves adding proper validation to ensure length fields meet minimum size requirements before any subtraction is performed.

Attack Vector

The attack vector for CVE-2026-25075 is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by initiating an IKEv2 connection to a vulnerable strongSwan server and sending specially crafted EAP-TTLS packets containing AVP data with invalid length fields.

The attack sequence involves establishing an initial IKE_SA_INIT exchange, then during the IKE_AUTH phase when EAP-TTLS authentication begins, the attacker sends malformed AVP data designed to trigger the integer underflow. The malformed packet causes the charon daemon to either attempt massive memory allocation or dereference a NULL pointer, resulting in daemon crash.

Since the vulnerability affects the core IKE daemon process, a successful attack crashes all active VPN connections and prevents new connections until the service is restarted. Persistent attackers can repeatedly crash the daemon to maintain a denial of service condition.

Detection Methods for CVE-2026-25075

Indicators of Compromise

• Unexpected charon daemon crashes or restarts, particularly during IKEv2 authentication phases
• Log entries indicating EAP-TTLS parsing errors or memory allocation failures
• Increased connection attempts from single sources followed by daemon failures
• Core dumps showing crashes in EAP-TTLS AVP parsing functions

Detection Strategies

• Monitor strongSwan charon daemon process for unexpected terminations or restarts
• Implement network-level IDS rules to detect malformed IKEv2 EAP-TTLS packets with suspicious length fields
• Configure alerting for rapid succession of IKEv2 connection attempts followed by daemon failures
• Enable detailed logging for EAP-TTLS authentication attempts to capture potential attack patterns

Monitoring Recommendations

• Set up automated monitoring for charon daemon uptime and stability metrics
• Configure log aggregation to detect patterns of authentication failures preceding crashes
• Implement process monitoring with automatic alerts when charon daemon terminates unexpectedly
• Review IKEv2 connection logs for anomalous patterns from external IP addresses

How to Mitigate CVE-2026-25075

Immediate Actions Required

• Upgrade strongSwan to version 6.0.5 or later immediately
• If immediate upgrade is not possible, consider temporarily disabling EAP-TTLS authentication
• Review firewall rules to limit IKEv2 access to trusted networks or IP ranges
• Implement rate limiting on IKEv2 connections to slow potential DoS attacks

Patch Information

strongSwan has released version 6.0.5 which addresses this integer underflow vulnerability. The patch adds proper validation of AVP length fields before performing subtraction operations, ensuring that malformed packets cannot trigger the underflow condition. Organizations should upgrade to strongSwan 6.0.5 or later as soon as possible.

For more information, see the strongSwan Release Announcement and the strongSwan CVE-2026-25075 Security Advisory.

Workarounds

• Disable EAP-TTLS authentication method if not required for operations
• Implement network segmentation to restrict access to IKEv2 services from untrusted networks
• Configure firewall rules to limit IKEv2 (UDP ports 500 and 4500) access to known trusted sources
• Deploy automated service restart mechanisms to minimize downtime from potential exploitation

# Configuration example - Disable EAP-TTLS in strongSwan
# Edit /etc/strongswan.conf or /etc/strongswan.d/charon.conf

# Restrict EAP methods to exclude TTLS until patched
charon {
    plugins {
        eap-ttls {
            load = no
        }
    }
}

# Alternatively, configure iptables to limit IKEv2 access
iptables -A INPUT -p udp --dport 500 -s trusted_network/24 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -s trusted_network/24 -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j DROP
iptables -A INPUT -p udp --dport 4500 -j DROP