CVE-2026-78127

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective...

3.7 LowFix available

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.41%Up 0.1 points since Sep 11, 2026

What each source reports

CVE List Score used 3.7

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

Record: CVE-2026-78127
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-401
Updated: 2026-11-02

EUVDEUVD-2026-75901 3.7

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

Record: EUVD-2026-75901
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j4c7-rfxg-2m4p 3.7

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective...

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

Record: GHSA-j4c7-rfxg-2m4p
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-401
Updated: 2026-11-02

NVD 3.7

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

Record: CVE-2026-78127
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-401
Updated: 2026-11-02

OSV 3.7

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

Record: CVE-2026-78127
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness: CWE-401
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-78127 3.7

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

Record: DEBIAN-CVE-2026-78127
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

Show 12 moreShow less

OSVUBUNTU-CVE-2026-78127 3.7

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

Record: UBUNTU-CVE-2026-78127
CVSS 3.1: 3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVAZL-100040 No score

CVE-2026-78127 affecting package strongswan for versions less than 5.9.14-11

libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser.

Record: AZL-100040
Updated: 2026-11-05

OSVMGASA-2026-0490 No score

Updated strongswan packages fix security vulnerabilities

Please see the links for aditional information about the vulnerabilities.

Record: MGASA-2026-0490
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11749-1 No score

strongswan-6.1.0-1.1 on GA media

These are all security issues fixed in the strongswan-6.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11749-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:22050-1 No score

Security update for strongswan

This update for strongswan fixes the following issues:

CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).
CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).
CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).
CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).
CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).
CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).
CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).
CVE-2026-78132: Infinite Loop When Parsing Attribute Certificates (bsc#1276544).
CVE-2026-78133: Use-After-Free During Multi-KE Rekey Collision (bsc#1276545).
CVE-2026-78134: Missing Inner EAP Method Authentication Details (bsc#1276548).
CVE-2026-78135: Creation of a Child SA Pre-Authentication (bsc#1276549).

Record: openSUSE-SU-2026:22050-1
Updated: 2026-11-02

OSVSUSE-SU-2026:24199-1 No score

Security update for strongswan

This update for strongswan fixes the following issues:

CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).
CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).
CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).
CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).
CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).
CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).
CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).
CVE-2026-78132: Infinite Loop When Parsing Attribute Certificates (bsc#1276544).
CVE-2026-78133: Use-After-Free During Multi-KE Rekey Collision (bsc#1276545).
CVE-2026-78134: Missing Inner EAP Method Authentication Details (bsc#1276548).
CVE-2026-78135: Creation of a Child SA Pre-Authentication (bsc#1276549).

Record: SUSE-SU-2026:24199-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4115-1 No score

Security update for strongswan

This update for strongswan fixes the following issues:

CVE-2026-47895: Double-Free When Destroying Certain Cloned Identities (bsc#1266360).
CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).
CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).
CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).
CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).
CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).
CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).
CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).
CVE-2026-78132: Infinite Loop When Parsing Attribute Certificates (bsc#1276544).
CVE-2026-78134: Missing Inner EAP Method Authentication Details (bsc#1276548).
CVE-2026-78135: Creation of a Child SA Pre-Authentication (bsc#1276549).

Record: SUSE-SU-2026:4115-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4143-1 No score

Security update for strongswan

This update for strongswan fixes the following issues:

CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).
CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).
CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).
CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).
CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).
CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).
CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).
CVE-2026-78132: Infinite Loop When Parsing Attribute Certificates (bsc#1276544).
CVE-2026-78134: Missing Inner EAP Method Authentication Details (bsc#1276548).

Record: SUSE-SU-2026:4143-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4146-1 No score

Security update for strongswan

This update for strongswan fixes the following issues:

CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).
CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).
CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).
CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).
CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).
CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).
CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).
CVE-2026-78132: Infinite Loop When Parsing Attribute Certificates (bsc#1276544).
CVE-2026-78134: Missing Inner EAP Method Authentication Details (bsc#1276548).
CVE-2026-78135: Creation of a Child SA Pre-Authentication (bsc#1276549).

Record: SUSE-SU-2026:4146-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4147-1 No score

Security update for strongswan

This update for strongswan fixes the following issues:

CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).
CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).
CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).
CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).
CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).
CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).
CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).

Record: SUSE-SU-2026:4147-1
Updated: 2026-11-02

OSVSUSE-SU-2026:4152-1 No score

Security update for strongswan

This update for strongswan fixes the following issues:

CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).
CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).
CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).
CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).
CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).
CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).
CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).
CVE-2026-78132: Infinite Loop When Parsing Attribute Certificates (bsc#1276544).
CVE-2026-78134: Missing Inner EAP Method Authentication Details (bsc#1276548).

Record: SUSE-SU-2026:4152-1
Updated: 2026-11-02

OSVUSN-8789-1 No score

strongswan vulnerabilities

It was discovered that strongSwan incorrectly handled PKCS#7 containers in the openssl plugin. A remote attacker could possibly use this issue to cause strongSwan to crash, resulting in a denial of service. (CVE-2026-78123)

It was discovered that strongSwan incorrectly handled memory when enumerating certificates in PKCS#7 containers in the openssl plugin. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-78124)

It was discovered that strongSwan incorrectly handled AKA-Synchronization-Failure messages in the eap-aka plugin. A remote attacker could possibly use this issue to cause strongSwan to crash, resulting in a denial of service. (CVE-2026-78126)

It was discovered that strongSwan incorrectly handled memory when stringifying IKE messages. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-78127)

It was discovered that strongSwan incorrectly handled PKCS#5 decryption. A remote attacker could possibly use this issue to cause strongSwan to consume excessive resources, leading to a denial of service. (CVE-2026-78129)

It was discovered that strongSwan incorrectly handled attribute certificates in the x509 plugin when the issuer name was missing. A remote attacker could possibly use this issue to cause strongSwan to crash, resulting in a denial of service. (CVE-2026-78130)

It was discovered that strongSwan incorrectly handled memory when parsing attribute certificates in the x509 plugin. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-78131)

It was discovered that strongSwan incorrectly handled attribute certificates containing ietfAttrSyntax values in the x509 plugin. A remote attacker could possibly use this issue to cause strongSwan to consume excessive resources, leading to a denial of service. (CVE-2026-78132)

It was discovered that strongSwan incorrectly handled IKEv2 rekeying collisions with multi-key exchange. A remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-78133)

It was discovered that strongSwan incorrectly validated inner EAP method authentication details in the eap-ttls and eap-peap plugins. An authenticated user could possibly use this issue to bypass authentication. (CVE-2026-78134)

It was discovered that strongSwan incorrectly handled CREATE_CHILD_SA requests on unestablished IKE_SAs. A remote attacker could possibly use this issue to bypass authentication. (CVE-2026-78135)

Record: USN-8789-1
Updated: 2026-11-02

Affected products

strongswan

Affected packages

Affected packages
Package	Affected	Fixed
`strongswan` Azure Linux:3	before 5.9.14-11	5.9.14-11
`strongswan` Debian:12	before 5.9.8-5+deb12u6, plus listed versions 5.9.8-55.9.8-5+deb12u15.9.8-5+deb12u25.9.8-5+deb12u35.9.8-5+deb12u45.9.8-5+deb12u5	5.9.8-5+deb12u6
`strongswan` Debian:13	before 6.0.1-6+deb13u7, plus listed versions 6.0.1-66.0.1-6+deb13u16.0.1-6+deb13u26.0.1-6+deb13u46.0.1-6+deb13u56.0.1-6+deb13u6	6.0.1-6+deb13u7
`strongswan` Debian:14	before 6.1.0-1, plus listed versions 6.0.1-66.0.2-16.0.3-16.0.4-16.0.5-16.0.6-16.0.7-1	6.1.0-1
`strongswan` Mageia:10 From an advisory covering 13 CVEs	before 6.1.0-1.mga10	6.1.0-1.mga10
`strongswan` SUSE:Linux Enterprise Server 16.0 From an advisory covering 11 CVEs	before 6.0.6-160000.3.1	6.0.6-160000.3.1
`strongswan` SUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 11 CVEs	before 6.0.6-160000.3.1	6.0.6-160000.3.1
`strongswan` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 11 CVEs	before 5.9.14-150700.3.21.2	5.9.14-150700.3.21.2
`strongswan` SUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 11 CVEs	before 5.9.14-150700.3.21.2	5.9.14-150700.3.21.2
`strongswan` SUSE:Linux Enterprise Workstation Extension 15 SP7 From an advisory covering 11 CVEs	before 5.9.14-150700.3.21.2	5.9.14-150700.3.21.2

Show 32 moreShow less

Affected packages
Package	Affected	Fixed
`strongswan` SUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 9 CVEs	before 5.9.12-150600.3.23.2	5.9.12-150600.3.23.2
`strongswan` SUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 9 CVEs	before 5.9.12-150600.3.23.2	5.9.12-150600.3.23.2
`strongswan` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 10 CVEs	before 5.9.11-150400.19.40.2	5.9.11-150400.19.40.2
`strongswan` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 10 CVEs	before 5.9.11-150400.19.40.2	5.9.11-150400.19.40.2
`strongswan` SUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 10 CVEs	before 5.9.11-150400.19.40.2	5.9.11-150400.19.40.2
`strongswan` SUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 10 CVEs	before 5.9.11-150400.19.40.2	5.9.11-150400.19.40.2
`strongswan` SUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 7 CVEs	before 5.1.3-26.43.2	5.1.3-26.43.2
`strongswan` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 7 CVEs	before 5.1.3-26.43.2	5.1.3-26.43.2
`strongswan` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 9 CVEs	before 5.9.11-150500.5.28.2	5.9.11-150500.5.28.2
`strongswan` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 9 CVEs	before 5.9.11-150500.5.28.2	5.9.11-150500.5.28.2
`strongswan` SUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 9 CVEs	before 5.9.11-150500.5.28.2	5.9.11-150500.5.28.2
`strongswan` SUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 9 CVEs	before 5.9.11-150500.5.28.2	5.9.11-150500.5.28.2
`strongswan` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 4.6.4-95.1.0-25.1.0-35.1.1-0ubuntu15.1.1-0ubuntu2 Show 25 moreShow less 5.1.1-0ubuntu35.1.1-0ubuntu45.1.1-0ubuntu55.1.1-0ubuntu75.1.1-0ubuntu145.1.1-0ubuntu175.1.2~dr3+git20130120-0ubuntu25.1.2~dr3+git20130120-0ubuntu35.1.2~rc1-0ubuntu35.1.2~rc1-0ubuntu45.1.2~rc2-0ubuntu25.1.2-0ubuntu15.1.2-0ubuntu25.1.2-0ubuntu2.25.1.2-0ubuntu2.35.1.2-0ubuntu2.45.1.2-0ubuntu2.55.1.2-0ubuntu2.65.1.2-0ubuntu2.75.1.2-0ubuntu2.85.1.2-0ubuntu2.105.1.2-0ubuntu2.115.1.2-0ubuntu2.11+esm15.1.2-0ubuntu2.11+esm25.1.2-0ubuntu2.11+esm3	None known
`strongswan` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 5.1.2-0ubuntu65.1.2-0ubuntu75.1.2-0ubuntu85.3.5-1ubuntu15.3.5-1ubuntu2 Show 12 moreShow less 5.3.5-1ubuntu35.3.5-1ubuntu3.15.3.5-1ubuntu3.25.3.5-1ubuntu3.35.3.5-1ubuntu3.45.3.5-1ubuntu3.55.3.5-1ubuntu3.75.3.5-1ubuntu3.85.3.5-1ubuntu3.8+esm15.3.5-1ubuntu3.8+esm25.3.5-1ubuntu3.8+esm35.3.5-1ubuntu3.8+esm4	None known
`strongswan` Ubuntu:Pro:FIPS-updates:16.04:LTS	All versions, plus listed versions 5.3.5-1ubuntu3.fips.3.4.15.3.5-1ubuntu3.fips.3.4.25.3.5-1ubuntu3.fips.3.8.15.3.5-1ubuntu3.fips.3.8.25.3.5-1ubuntu3.fips.3.8.35.3.5-1ubuntu3.fips.3.8.65.3.5-1ubuntu3.fips.3.8.7	None known
`strongswan` Ubuntu:Pro:FIPS:16.04:LTS	All versions, plus listed versions 5.3.5-1ubuntu3.fips.3.15.3.5-1ubuntu3.fips.3.25.3.5-1ubuntu3.fips.3.3	None known
`strongswan` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 5.5.1-4ubuntu25.5.1-4ubuntu35.6.1-2ubuntu15.6.1-2ubuntu25.6.1-2ubuntu3 Show 11 moreShow less 5.6.1-2ubuntu45.6.2-1ubuntu25.6.2-1ubuntu2.25.6.2-1ubuntu2.35.6.2-1ubuntu2.45.6.2-1ubuntu2.55.6.2-1ubuntu2.65.6.2-1ubuntu2.75.6.2-1ubuntu2.85.6.2-1ubuntu2.95.6.2-1ubuntu2.9+esm1	None known
`strongswan` Ubuntu:Pro:FIPS-updates:18.04:LTS	All versions, plus listed versions 5.6.2-1ubuntu2.fips.2.5.15.6.2-1ubuntu2.fips.2.7.15.6.2-1ubuntu2.fips.2.7.25.6.2-1ubuntu2.fips.2.8.15.6.2-1ubuntu2.fips.2.95.6.2-1ubuntu2.fips.2.9+esm1	None known
`strongswan` Ubuntu:Pro:FIPS:18.04:LTS	All versions, plus listed versions 5.6.2-1ubuntu2.fips.2.4.25.6.2-1ubuntu2.fips.2.5.1	None known
`strongswan` Ubuntu:20.04:LTS	All versions, plus listed versions 5.7.2-1ubuntu35.8.1-1ubuntu15.8.2-1ubuntu15.8.2-1ubuntu25.8.2-1ubuntu3 Show 6 moreShow less 5.8.2-1ubuntu3.15.8.2-1ubuntu3.25.8.2-1ubuntu3.35.8.2-1ubuntu3.45.8.2-1ubuntu3.55.8.2-1ubuntu3.6	None known
`strongswan` Ubuntu:Pro:FIPS-updates:20.04:LTS	All versions, plus listed versions 5.8.2-1ubuntu3.fips.3.1.25.8.2-1ubuntu3.fips.3.3.15.8.2-1ubuntu3.fips.3.4.15.8.2-1ubuntu3.fips.3.55.8.2-1ubuntu3.fips.3.6	None known
`strongswan` Ubuntu:Pro:FIPS:20.04:LTS	All versions, plus listed versions 5.8.2-1ubuntu3.fips.3.1.2	None known
`strongswan` Ubuntu:22.04:LTS	before 5.9.5-2ubuntu2.8, plus listed versions 5.9.1-1ubuntu35.9.1-1ubuntu3.15.9.4-1ubuntu15.9.4-1ubuntu25.9.4-1ubuntu3 Show 10 moreShow less 5.9.4-1ubuntu45.9.5-2ubuntu15.9.5-2ubuntu25.9.5-2ubuntu2.15.9.5-2ubuntu2.25.9.5-2ubuntu2.35.9.5-2ubuntu2.45.9.5-2ubuntu2.55.9.5-2ubuntu2.65.9.5-2ubuntu2.7	5.9.5-2ubuntu2.8
`strongswan` Ubuntu:Pro:FIPS-preview:22.04:LTS	All versions, plus listed versions 5.9.5-2ubuntu2.1+Fips15.9.5-2ubuntu2.2+Fips1	None known
`strongswan` Ubuntu:Pro:FIPS-updates:22.04:LTS	All versions, plus listed versions 5.9.5-2ubuntu2.1+Fips15.9.5-2ubuntu2.2+Fips15.9.5-2ubuntu2.3+Fips15.9.5-2ubuntu2.4+Fips15.9.5-2ubuntu2.5+Fips15.9.5-2ubuntu2.6+Fips15.9.5-2ubuntu2.7+Fips15.9.5-2ubuntu2.8+Fips1	None known
`strongswan` Ubuntu:24.04:LTS	before 5.9.13-2ubuntu4.24.04.5, plus listed versions 5.9.11-1ubuntu15.9.11-1ubuntu25.9.12-1ubuntu15.9.13-2ubuntu15.9.13-2ubuntu3 Show 5 moreShow less 5.9.13-2ubuntu45.9.13-2ubuntu4.24.04.15.9.13-2ubuntu4.24.04.25.9.13-2ubuntu4.24.04.35.9.13-2ubuntu4.24.04.4	5.9.13-2ubuntu4.24.04.5
`strongswan` Ubuntu:26.04:LTS	before 6.0.4-1ubuntu3.2, plus listed versions 6.0.1-6ubuntu46.0.1-6ubuntu56.0.4-1ubuntu16.0.4-1ubuntu26.0.4-1ubuntu36.0.4-1ubuntu3.1	6.0.4-1ubuntu3.2
`strongswan` Ubuntu:22.04:LTS From an advisory covering 11 CVEs	before 5.9.5-2ubuntu2.8, plus listed versions 5.9.1-1ubuntu35.9.1-1ubuntu3.15.9.4-1ubuntu15.9.4-1ubuntu25.9.4-1ubuntu3 Show 10 moreShow less 5.9.4-1ubuntu45.9.5-2ubuntu15.9.5-2ubuntu25.9.5-2ubuntu2.15.9.5-2ubuntu2.25.9.5-2ubuntu2.35.9.5-2ubuntu2.45.9.5-2ubuntu2.55.9.5-2ubuntu2.65.9.5-2ubuntu2.7	5.9.5-2ubuntu2.8
`strongswan` Ubuntu:24.04:LTS From an advisory covering 11 CVEs	before 5.9.13-2ubuntu4.24.04.5, plus listed versions 5.9.11-1ubuntu15.9.11-1ubuntu25.9.12-1ubuntu15.9.13-2ubuntu15.9.13-2ubuntu3 Show 5 moreShow less 5.9.13-2ubuntu45.9.13-2ubuntu4.24.04.15.9.13-2ubuntu4.24.04.25.9.13-2ubuntu4.24.04.35.9.13-2ubuntu4.24.04.4	5.9.13-2ubuntu4.24.04.5
`strongswan` Ubuntu:26.04:LTS From an advisory covering 11 CVEs	before 6.0.4-1ubuntu3.2, plus listed versions 6.0.1-6ubuntu46.0.1-6ubuntu56.0.4-1ubuntu16.0.4-1ubuntu26.0.4-1ubuntu36.0.4-1ubuntu3.1	6.0.4-1ubuntu3.2
`strongswan` openSUSE:Tumbleweed From an advisory covering 9 CVEs	before 6.1.0-1.1	6.1.0-1.1
`strongswan` openSUSE:Leap 16.0 From an advisory covering 11 CVEs	before 6.0.6-160000.3.1	6.0.6-160000.3.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 2, 2026	affected, aliases	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78127 is a low vulnerability (CVSS 3.7) in Strongswan, published September 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in strongswan 5.9.14-11.

References

Show 51 moreShow less