CVE-2026-78133: strongSwan IKEv2 Use-After-Free Vulnerability

CVE-2026-78133 Overview

CVE-2026-78133 is a use-after-free vulnerability [CWE-416] in the libcharon component of strongSwan versions 6.0.0 through 6.0.7. The flaw resides in Internet Key Exchange version 2 (IKEv2) rekeying collision handling. An authenticated remote peer can trigger memory corruption during simultaneous rekey negotiations. Successful exploitation may lead to daemon crashes, denial of service, or arbitrary code execution within the charon IKE daemon process. The strongSwan project released version 6.1.0 to address the issue on September 7, 2026.

Critical Impact
A remote authenticated attacker can corrupt memory in the charon IKE daemon by inducing rekey collisions, potentially compromising VPN gateway confidentiality, integrity, and availability.

Affected Products

strongSwan 6.0.0
strongSwan 6.0.1 through 6.0.6
strongSwan 6.0.7

Discovery Timeline

2026-09-07 - strongSwan project publishes advisory and releases patched version 6.1.0
2026-09-11 - CVE-2026-78133 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-78133

Vulnerability Analysis

The vulnerability affects libcharon, the library implementing the IKEv2 protocol state machine in strongSwan. IKEv2 rekeying refreshes cryptographic material for Security Associations (SAs) before they expire. When both peers initiate rekeying simultaneously, a collision occurs and the protocol requires one exchange to be preserved while the other is discarded.

The collision-handling logic in affected versions frees an SA object while retaining references that are later dereferenced. Subsequent access to the freed memory produces undefined behavior, ranging from process termination to controlled memory reuse. Because charon typically runs with elevated privileges on VPN gateways, exploitation impacts confidentiality, integrity, and availability of tunneled traffic.

Root Cause

The root cause is improper lifetime management of IKE Security Association structures during concurrent rekey negotiations. The code path that handles the losing side of a rekey collision releases the associated memory without invalidating pointers held elsewhere in the state machine, satisfying the classic use-after-free pattern described in [CWE-416].

Attack Vector

Exploitation requires network reachability to the IKE daemon on UDP ports 500 and 4500, plus the ability to complete IKE_SA authentication as a legitimate peer. The attacker then races the gateway to initiate a rekey at the same moment the gateway initiates its own, producing the collision condition. High attack complexity reflects the timing precision required to reliably trigger the freed-object reuse. Refer to the strongSwan security advisory for protocol-level details.

Detection Methods for CVE-2026-78133

Indicators of Compromise

Unexpected charon daemon crashes, restarts, or segmentation faults recorded in /var/log/syslog or journalctl -u strongswan
IKE_SA state inconsistencies where rekey exchanges terminate abnormally between the same peer pair within seconds
Core dumps produced by the charon process referencing SA management functions
Elevated volume of CREATE_CHILD_SA requests from a single peer in a short interval

Detection Strategies

Inventory strongSwan installations and identify hosts running versions 6.0.0 through 6.0.7 using package managers or ipsec version
Enable verbose IKEv2 logging (charondebug = ike 2, cfg 2) to capture rekey collision events for correlation
Deploy network detection rules that flag rapid, repeated CREATE_CHILD_SA exchanges from the same source IP
Monitor IPsec gateway process supervisors for charon restart loops that indicate crash-based exploitation attempts

Monitoring Recommendations

Forward strongSwan logs to a centralized SIEM and alert on repeated daemon terminations correlated with peer IP addresses
Track baseline rekey frequency per tunnel and alert on statistical anomalies
Instrument endpoint monitoring to capture core dumps from charon for forensic analysis
Review authentication logs for peers that repeatedly initiate short-lived IKE_SAs followed by rekey attempts

How to Mitigate CVE-2026-78133

Immediate Actions Required

Upgrade strongSwan to version 6.1.0 or later on all VPN gateways and endpoints running affected releases
Restrict IKE UDP ports 500 and 4500 to known peer IP addresses using firewall access control lists
Audit configured peer credentials and revoke access for any peer that is no longer trusted
Enable process supervision (systemd restart policies) to reduce availability impact while patching is scheduled

Patch Information

The strongSwan maintainers fixed the use-after-free in the strongSwan 6.1.0 release, published on September 7, 2026. Administrators using distribution packages should apply vendor backports as soon as they become available. Full remediation details are documented in the strongSwan project advisory.

Workarounds

Limit inbound IKE traffic to authenticated peer subnets using host or network firewalls until patching completes
Increase SA lifetime values to reduce the frequency of rekey exchanges and lower the probability of collision-based exploitation
Disable IKEv2 rekeying on affected tunnels where operationally acceptable by setting rekey = no in the connection configuration
Monitor charon daemon health and configure automatic restart to maintain tunnel availability

bash

# Example: restrict rekey behavior in swanctl.conf as a temporary mitigation
connections {
    peer-gateway {
        rekey_time = 0
        reauth_time = 0
        children {
            net {
                rekey_time = 0
            }
        }
    }
}