CVE-2026-47895: strongSwan Use After Free Vulnerability

CVE-2026-47895 Overview

CVE-2026-47895 is a double-free vulnerability in strongSwan, an open-source IPsec-based VPN solution. The flaw resides in the identity parsing and cloning logic of the strongSwan daemon. Parsed Extensible Authentication Protocol (EAP) identities that produce an empty but non-NULL encoding are not cloned correctly. When the duplicated identity objects are destroyed, the process triggers a double-free condition. The issue affects all strongSwan versions prior to 6.0.7 and is tracked under CWE-415.

Critical Impact
An authenticated attacker on the network can trigger memory corruption in the strongSwan daemon, leading to denial of service or potential code execution against VPN gateways.

Affected Products

strongSwan versions prior to 6.0.7
Deployments using EAP-Identity authentication for IKEv2 tunnels
VPN gateways, remote access concentrators, and site-to-site tunnels built on strongSwan

Discovery Timeline

2026-08-22 - CVE-2026-47895 published to the National Vulnerability Database
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-47895

Vulnerability Analysis

The defect resides in strongSwan's identity subsystem, which represents peer identifiers used during Internet Key Exchange version 2 (IKEv2) authentication. During EAP authentication, the responder parses an EAP-Identity payload received from the initiator. Certain malformed inputs produce an identity object whose internal encoding buffer has zero length but a non-NULL pointer.

When strongSwan clones this identity, for example to attach it to a session or child SA, the clone routine does not correctly account for the empty-but-non-NULL encoding. Both the original object and its duplicate end up referencing the same underlying allocation. When either object is later destroyed, free() is called on the shared pointer. Destruction of the second object then frees the same memory a second time, resulting in a classic double-free.

Root Cause

The root cause is inconsistent handling of empty encodings in the identity clone path. The parser produces a non-NULL pointer to a zero-length buffer, while the clone function assumes an empty encoding implies a NULL pointer. Ownership of the buffer is therefore not duplicated, violating heap allocator invariants when both copies are released.

Attack Vector

Exploitation requires a network-adjacent attacker who can send a crafted EAP-Identity payload to a strongSwan responder that accepts EAP authentication. The CVSS vector indicates high attack complexity and low privileges, reflecting the need to reach the IKEv2 responder and negotiate to the EAP-Identity exchange. Successful exploitation corrupts the heap, which can crash charon (denial of service) or, depending on allocator state, be leveraged toward arbitrary code execution.

No public proof-of-concept exploit is available at this time. Technical details are provided in the strongSwan 6.0.7 release notes.

Detection Methods for CVE-2026-47895

Indicators of Compromise

Unexpected crashes or restarts of the charon daemon on strongSwan gateways
Core dumps referencing identification_t, chunk_clone, or free() in the call stack
Repeated IKEv2 negotiations from a single source terminating during the EAP-Identity phase
Kernel messages indicating double-free or heap corruption from the strongSwan process

Detection Strategies

Monitor charon.log and syslog for repeated segmentation faults, SIGABRT, or glibc double-free abort messages tied to strongSwan.
Alert on rapid restarts of the strongSwan service through systemd or process supervisors.
Correlate IKEv2 authentication failures with malformed or empty EAP-Identity payloads at the network sensor layer.

Monitoring Recommendations

Enable verbose IKE logging on VPN gateways and forward logs to a centralized SIEM for anomaly detection.
Track process uptime and crash counts for the strongSwan daemon as a health metric.
Baseline the volume of EAP-Identity exchanges per source to identify probing behavior.

How to Mitigate CVE-2026-47895

Immediate Actions Required

Upgrade strongSwan to version 6.0.7 or later on all VPN gateways and clients.
Inventory all systems running strongSwan, including appliance firmware that embeds the daemon.
Restrict inbound IKEv2 (UDP/500, UDP/4500) to trusted peers where feasible until patching is complete.
Restart the charon daemon after upgrading to ensure the patched binary is loaded.

Patch Information

The fix is delivered in strongSwan 6.0.7. Source tarballs and release notes are available on the strongSwan 6.0.7 release page and the official strongSwan download page. Distribution maintainers have begun backporting the patch; verify that your Linux distribution ships a fixed package version.

Workarounds

Disable EAP-Identity based authentication methods on the responder if operationally acceptable.
Limit IKEv2 exposure to known client IP ranges using host or perimeter firewalls.
Deploy rate limiting on IKEv2 endpoints to slow repeated exploitation attempts against unpatched hosts.

bash

# Verify installed strongSwan version and upgrade
ipsec version
# On Debian/Ubuntu after repository update
apt-get update && apt-get install --only-upgrade strongswan
# Restart the IKE daemon
systemctl restart strongswan