CVE-2026-78130: strongSwan NULL Pointer Dereference Flaw

CVE-2026-78130 Overview

CVE-2026-78130 is a NULL pointer dereference vulnerability [CWE-476] in the strongSwan x509 plugin's attribute certificate parser. The flaw affects strongSwan versions 4.2.0 through 6.0.7. A remote unauthenticated attacker can trigger the dereference by sending a crafted attribute certificate to a vulnerable IKE daemon, causing the process to crash. strongSwan is a widely deployed open-source IPsec-based VPN solution used across enterprise and service-provider networks.

Critical Impact
Remote attackers can crash the strongSwan IPsec daemon without authentication, disrupting VPN connectivity for all tunneled users and services.

Affected Products

strongSwan 4.2.0 through 6.0.7
Deployments using the x509 plugin with attribute certificate processing enabled
IPsec/IKEv2 gateways relying on strongSwan for site-to-site or remote-access VPN

Discovery Timeline

2026-09-07 - strongSwan project publishes advisory for CVE-2026-78130
2026-09-11 - CVE-2026-78130 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-78130

Vulnerability Analysis

The vulnerability resides in the x509 plugin's attribute certificate parser. When strongSwan parses a malformed or unexpected attribute certificate structure, the parser dereferences a NULL pointer, aborting the charon daemon. The impact is limited to availability: confidentiality and integrity are not affected. However, IPsec tunnels terminate abruptly when the daemon crashes, and any subsequent IKE negotiations fail until the process is restarted. Attackers can repeat the attack to hold the VPN gateway in a denial-of-service state.

Root Cause

The parser fails to validate a pointer returned from a subordinate parsing routine before dereferencing it. Attribute certificates contain optional ASN.1 fields, and the affected code path assumes a parsed component is always populated. Supplying a certificate that omits or malforms this component causes the dereference. The x509 plugin ships enabled in default builds, exposing standard configurations.

Attack Vector

Exploitation requires only network access to the IKE listener, typically UDP ports 500 and 4500. No authentication or user interaction is required. An attacker sends a specially crafted attribute certificate during IKE exchange or certificate payload processing. The charon daemon dereferences the NULL pointer and terminates. See the strongSwan advisory for parser-level detail.

No public proof-of-concept code is available at this time. Refer to the strongSwan 6.1.0 release notes for the specific parser changes that address the flaw.

Detection Methods for CVE-2026-78130

Indicators of Compromise

Unexpected termination or repeated restarts of the charon daemon in syslog or journalctl output
IKE_SA_INIT or IKE_AUTH exchanges that abort immediately after certificate payload processing
Sudden loss of established IPsec tunnels without corresponding administrative action
Inbound IKE traffic containing attribute certificates from unexpected sources

Detection Strategies

Monitor process supervisors (systemd, monit) for charon crash and restart events
Alert on IKE session failures correlated with certificate-bearing payloads from external peers
Inspect packet captures on UDP 500 and UDP 4500 for malformed X.509 attribute certificate structures

Monitoring Recommendations

Ship strongSwan logs to a centralized SIEM and build alerts on daemon crash signatures
Baseline normal IKE peer identities and flag negotiations from unknown source addresses
Track VPN tunnel uptime metrics; sudden drops across multiple tunnels can indicate exploitation attempts

How to Mitigate CVE-2026-78130

Immediate Actions Required

Upgrade strongSwan to version 6.1.0 or later on all IPsec gateways and clients
Inventory hosts running strongSwan 4.2.0 through 6.0.7 and prioritize internet-facing gateways
Restrict UDP 500 and UDP 4500 exposure to known peer addresses where operationally feasible
Enable automatic restart of the charon daemon to reduce outage duration if exploitation occurs

Patch Information

The strongSwan project fixed the NULL pointer dereference in the 6.1.0 release. Download and build instructions are available at the strongSwan 6.1.0 GitHub release. Distributions shipping older strongSwan packages should apply vendor backports as they become available.

Workarounds

Disable the x509 plugin in strongswan.conf if attribute certificates are not required for your deployment
Terminate IKE traffic behind an upstream firewall that enforces strict peer allowlists
Apply rate limiting on UDP 500 and UDP 4500 to slow repeated crash attempts

bash

# Disable the x509 plugin in strongswan.conf if attribute certificates are unused
charon {
    load_modular = yes
    plugins {
        x509 {
            load = no
        }
    }
}

# Restart the daemon to apply the change
systemctl restart strongswan