CVE-2023-41913
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution...
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
CVE-2023-41913- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
CVE-2023-41913- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2023-46391
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
EUVD-2023-46391- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g7mg-4vgp-5j3h
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution...
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
GHSA-g7mg-4vgp-5j3h- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVALPINE-CVE-2023-41913
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
ALPINE-CVE-2023-41913- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-32071
CVE-2023-41913 affecting package strongswan for versions less than 5.9.10-3
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
AZL-32071- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVAZL-35287
CVE-2023-41913 affecting package strongswan for versions less than 5.9.12-1
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
AZL-35287- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
CVE-2023-41913- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-41913
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
DEBIAN-CVE-2023-41913- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2023-1945
strongswan security update
The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel.
Security Fix(es):
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.(CVE-2023-41913)
- Record
OESA-2023-1945- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-41913
strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.
- Record
UBUNTU-CVE-2023-41913- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2024-0216 No score
Updated strongswan packages fix security vulnerability
Fixes CVE-2023-41913 buffer overflow and possible RCE, various IKEv2 improvements
- Record
MGASA-2024-0216- Updated
- 2026-11-02
OSVSUSE-SU-2023:4514-1 No score
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2023-41913: Fixed a bug in charon-tkm related to handling DH public values that can lead to remote code execution (bsc#1216901).
- Record
SUSE-SU-2023:4514-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4515-1 No score
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2023-41913: Fixed a bug in charon-tkm related to handling DH public values that can lead to remote code execution (bsc#1216901).
- Record
SUSE-SU-2023:4515-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4516-1 No score
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2023-41913: Fixed a bug in charon-tkm related to handling DH public values that can lead to remote code execution (bsc#1216901).
- Record
SUSE-SU-2023:4516-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:4529-1 No score
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2023-41913: Fixed a bug in charon-tkm related to handling DH public values that can lead to remote code execution (bsc#1216901).
- Record
SUSE-SU-2023:4529-1- Updated
- 2026-11-02
OSVUSN-6488-1 No score
strongswan vulnerability
Florian Picca discovered that strongSwan incorrectly handled certain DH public values. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-6488-1- Updated
- 2026-11-02
OSVUSN-6488-2 No score
strongswan vulnerability
USN-6488-1 fixed a vulnerability in strongSwan. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
Florian Picca discovered that strongSwan incorrectly handled certain DH public values. A remote attacker could use this issue to cause strongSwan to crash, resulting in a denial of service, or possibly execute arbitrary code.
- Record
USN-6488-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
strongswanAlpine:v3.17 |
5.3.0 up to 5.9.12-r0 | 5.9.12-r0 |
strongswanAlpine:v3.18 |
5.3.0 up to 5.9.12-r0 | 5.9.12-r0 |
strongswanAlpine:v3.19 |
5.3.0 up to 5.9.12-r0 | 5.9.12-r0 |
strongswanAlpine:v3.20 |
5.3.0 up to 5.9.12-r0 | 5.9.12-r0 |
strongswanAlpine:v3.21 |
5.3.0 up to 5.9.12-r0 | 5.9.12-r0 |
strongswanAlpine:v3.22 |
5.3.0 up to 5.9.12-r0 | 5.9.12-r0 |
strongswanAlpine:v3.23 |
5.3.0 up to 5.9.12-r0 | 5.9.12-r0 |
strongswanAlpine:v3.24 |
5.3.0 up to 5.9.12-r0 | 5.9.12-r0 |
strongswanAzure Linux:2 |
before 5.9.10-3 | 5.9.10-3 |
strongswanAzure Linux:3 |
before 5.9.12-1 | 5.9.12-1 |
Show 35 moreShow less
| Package | Affected | Fixed |
|---|---|---|
strongswanDebian:12 |
before 5.9.8-5+deb12u1, plus listed versions 5.9.8-5 |
5.9.8-5+deb12u1 |
strongswanDebian:13 |
before 5.9.12-1 | 5.9.12-1 |
strongswanDebian:14 |
before 5.9.12-1 | 5.9.12-1 |
strongswanDebian:10 |
before 5.7.2-1+deb10u4, plus listed versions 5.7.2-15.7.2-1+deb10u15.7.2-1+deb10u25.7.2-1+deb10u3 |
5.7.2-1+deb10u4 |
strongswanDebian:11 |
before 5.9.1-1+deb11u4, plus listed versions 5.9.1-15.9.1-1+deb11u15.9.1-1+deb11u25.9.1-1+deb11u3 |
5.9.1-1+deb11u4 |
strongswanMageia:9 |
before 5.9.14-1.mga9 | 5.9.14-1.mga9 |
strongswanopenEuler:20.03-LTS-SP1 |
before 5.7.2-11.oe1 | 5.7.2-11.oe1 |
strongswanopenEuler:20.03-LTS-SP3 |
before 5.7.2-11.oe1 | 5.7.2-11.oe1 |
strongswanopenEuler:20.03-LTS-SP4 |
before 5.7.2-11.oe2003sp4 | 5.7.2-11.oe2003sp4 |
strongswanopenEuler:22.03-LTS |
before 5.9.7-5.oe2203sp2 | 5.9.7-5.oe2203sp2 |
strongswanopenEuler:22.03-LTS-SP1 |
before 5.9.7-5.oe2203sp1 | 5.9.7-5.oe2203sp1 |
strongswanopenEuler:22.03-LTS-SP2 |
before 5.9.7-5.oe2203sp2 | 5.9.7-5.oe2203sp2 |
strongswanSUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 5.9.11-150400.19.17.2 | 5.9.11-150400.19.17.2 |
strongswanSUSE:Linux Enterprise Module for Package Hub 15 SP4 |
before 5.9.11-150400.19.17.2 | 5.9.11-150400.19.17.2 |
strongswanSUSE:Linux Enterprise Workstation Extension 15 SP4 |
before 5.9.11-150400.19.17.2 | 5.9.11-150400.19.17.2 |
strongswanopenSUSE:Leap 15.4 |
before 5.9.11-150400.19.17.2 | 5.9.11-150400.19.17.2 |
strongswanSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 5.8.2-150200.11.42.2 | 5.8.2-150200.11.42.2 |
strongswanSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS |
before 5.8.2-150200.11.42.2 | 5.8.2-150200.11.42.2 |
strongswanSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 5.8.2-150200.11.42.2 | 5.8.2-150200.11.42.2 |
strongswanSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 5.8.2-150200.11.42.2 | 5.8.2-150200.11.42.2 |
strongswanSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 5.8.2-150200.11.42.2 | 5.8.2-150200.11.42.2 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 5.8.2-150200.11.42.2 | 5.8.2-150200.11.42.2 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 5.8.2-150200.11.42.2 | 5.8.2-150200.11.42.2 |
strongswanSUSE:Enterprise Storage 7.1 |
before 5.8.2-150200.11.42.2 | 5.8.2-150200.11.42.2 |
strongswanSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 5.8.2-150000.4.23.2 | 5.8.2-150000.4.23.2 |
strongswanSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 5.8.2-150000.4.23.2 | 5.8.2-150000.4.23.2 |
strongswanSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 5.8.2-150000.4.23.2 | 5.8.2-150000.4.23.2 |
strongswanSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 5.9.11-150500.5.6.1 | 5.9.11-150500.5.6.1 |
strongswanSUSE:Linux Enterprise Module for Package Hub 15 SP5 |
before 5.9.11-150500.5.6.1 | 5.9.11-150500.5.6.1 |
strongswanSUSE:Linux Enterprise Workstation Extension 15 SP5 |
before 5.9.11-150500.5.6.1 | 5.9.11-150500.5.6.1 |
strongswanopenSUSE:Leap 15.5 |
before 5.9.11-150500.5.6.1 | 5.9.11-150500.5.6.1 |
strongswanUbuntu:Pro:16.04:LTS |
before 5.3.5-1ubuntu3.8+esm4, plus listed versions 5.1.2-0ubuntu65.1.2-0ubuntu75.1.2-0ubuntu85.3.5-1ubuntu15.3.5-1ubuntu2 Show 11 moreShow less5.3.5-1ubuntu35.3.5-1ubuntu3.15.3.5-1ubuntu3.25.3.5-1ubuntu3.35.3.5-1ubuntu3.45.3.5-1ubuntu3.55.3.5-1ubuntu3.75.3.5-1ubuntu3.85.3.5-1ubuntu3.8+esm15.3.5-1ubuntu3.8+esm25.3.5-1ubuntu3.8+esm3 |
5.3.5-1ubuntu3.8+esm4 |
strongswanUbuntu:Pro:18.04:LTS |
before 5.6.2-1ubuntu2.9+esm1, plus listed versions 5.5.1-4ubuntu25.5.1-4ubuntu35.6.1-2ubuntu15.6.1-2ubuntu25.6.1-2ubuntu3 Show 10 moreShow less5.6.1-2ubuntu45.6.2-1ubuntu25.6.2-1ubuntu2.25.6.2-1ubuntu2.35.6.2-1ubuntu2.45.6.2-1ubuntu2.55.6.2-1ubuntu2.65.6.2-1ubuntu2.75.6.2-1ubuntu2.85.6.2-1ubuntu2.9 |
5.6.2-1ubuntu2.9+esm1 |
strongswanUbuntu:20.04:LTS |
before 5.8.2-1ubuntu3.6, plus listed versions 5.7.2-1ubuntu35.8.1-1ubuntu15.8.2-1ubuntu15.8.2-1ubuntu25.8.2-1ubuntu3 Show 5 moreShow less5.8.2-1ubuntu3.15.8.2-1ubuntu3.25.8.2-1ubuntu3.35.8.2-1ubuntu3.45.8.2-1ubuntu3.5 |
5.8.2-1ubuntu3.6 |
strongswanUbuntu:22.04:LTS |
before 5.9.5-2ubuntu2.2, plus listed versions 5.9.1-1ubuntu35.9.1-1ubuntu3.15.9.4-1ubuntu15.9.4-1ubuntu25.9.4-1ubuntu3 Show 4 moreShow less5.9.4-1ubuntu45.9.5-2ubuntu15.9.5-2ubuntu25.9.5-2ubuntu2.1 |
5.9.5-2ubuntu2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41913 is a critical vulnerability (CVSS 9.8) in Strongswan, published November 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in strongswan 5.9.12-r0.
References
github.com/strongswan/strongswan/releases
strongswan.org/blog/2023/11/20/strongswan-vulnerability-%28cve-2023-41913%29.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPJZPYHBCRXUQGGKQE6TYH4J4RIJH6HO
security.netapp.com/advisory/ntap-20250117-0003
lists.debian.org/debian-lts-announce/2023/11/msg00018.html
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-41913
security.alpinelinux.org/vuln/CVE-2023-41913
security-tracker.debian.org/tracker/CVE-2023-41913
advisories.mageia.org/MGASA-2024-0216.html
bugs.mageia.org/show_bug.cgi?id=33286
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1945
suse.com/support/update/announcement/2023/suse-su-20234514-1
bugzilla.suse.com/1216901
ubuntu.com/security/CVE-2023-41913
cve.org/CVERecord?id=CVE-2023-41913