{"id":"CVE-2026-47895","aliases":["ALPINE-CVE-2026-47895","AZL-97377","DEBIAN-CVE-2026-47895","EUVD-2026-64602","GHSA-55p5-7gvc-767j","MGASA-2026-0490","SUSE-SU-2026:22168-1","SUSE-SU-2026:2312-1","SUSE-SU-2026:2368-1","SUSE-SU-2026:2459-1","SUSE-SU-2026:4115-1","UBUNTU-CVE-2026-47895","USN-8407-1","openSUSE-SU-2026:11005-1","openSUSE-SU-2026:21092-1"],"status":"published","title":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that...","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00416,"percentile":0.3623,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-415"],"published":"2026-06-08T12:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"strongswan","fixed_in":["6.0.7-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"strongswan","fixed_in":["5.9.14-10"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"strongswan","fixed_in":["5.9.8-5+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"strongswan","fixed_in":["6.0.1-6+deb13u6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"strongswan","fixed_in":["6.0.7-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"strongswan","fixed_in":["6.0.6-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"strongswan","fixed_in":["6.0.6-160000.2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"strongswan","fixed_in":["5.1.3-26.38.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"strongswan","fixed_in":["5.1.3-26.38.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"strongswan","fixed_in":["5.9.5-2ubuntu2.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"strongswan","fixed_in":["5.9.5-2ubuntu2.7+Fips1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"strongswan","fixed_in":["5.9.13-2ubuntu4.24.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"strongswan","fixed_in":["6.0.1-6ubuntu4.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"strongswan","fixed_in":["6.0.4-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"strongswan","fixed_in":["6.0.7-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"strongswan","fixed_in":["6.0.6-160000.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.7-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.14-10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.8-5+deb12u5"}]}],"versions":["5.9.8-5","5.9.8-5+deb12u1","5.9.8-5+deb12u2","5.9.8-5+deb12u3","5.9.8-5+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1-6+deb13u6"}]}],"versions":["6.0.1-6","6.0.1-6+deb13u1","6.0.1-6+deb13u2","6.0.1-6+deb13u4","6.0.1-6+deb13u5"]},{"source":"osv","ecosystem":"Debian:14","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.7-1"}]}],"versions":["6.0.1-6","6.0.2-1","6.0.3-1","6.0.4-1","6.0.5-1","6.0.6-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-1.mga10"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.6-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.6-160000.2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-26.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.3-26.38.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.11-150400.19.35.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.11-150400.19.35.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.11-150400.19.35.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.11-150400.19.35.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.11-150500.5.23.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.11-150500.5.23.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.11-150500.5.23.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.11-150500.5.23.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.14-150700.3.21.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.14-150700.3.21.2"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.14-150700.3.21.2"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.6.4-9","5.1.0-2","5.1.0-3","5.1.1-0ubuntu1","5.1.1-0ubuntu2","5.1.1-0ubuntu3","5.1.1-0ubuntu4","5.1.1-0ubuntu5","5.1.1-0ubuntu7","5.1.1-0ubuntu14","5.1.1-0ubuntu17","5.1.2~dr3+git20130120-0ubuntu2","5.1.2~dr3+git20130120-0ubuntu3","5.1.2~rc1-0ubuntu3","5.1.2~rc1-0ubuntu4","5.1.2~rc2-0ubuntu2","5.1.2-0ubuntu1","5.1.2-0ubuntu2","5.1.2-0ubuntu2.2","5.1.2-0ubuntu2.3","5.1.2-0ubuntu2.4","5.1.2-0ubuntu2.5","5.1.2-0ubuntu2.6","5.1.2-0ubuntu2.7","5.1.2-0ubuntu2.8","5.1.2-0ubuntu2.10","5.1.2-0ubuntu2.11","5.1.2-0ubuntu2.11+esm1","5.1.2-0ubuntu2.11+esm2","5.1.2-0ubuntu2.11+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.2-0ubuntu6","5.1.2-0ubuntu7","5.1.2-0ubuntu8","5.3.5-1ubuntu1","5.3.5-1ubuntu2","5.3.5-1ubuntu3","5.3.5-1ubuntu3.1","5.3.5-1ubuntu3.2","5.3.5-1ubuntu3.3","5.3.5-1ubuntu3.4","5.3.5-1ubuntu3.5","5.3.5-1ubuntu3.7","5.3.5-1ubuntu3.8","5.3.5-1ubuntu3.8+esm1","5.3.5-1ubuntu3.8+esm2","5.3.5-1ubuntu3.8+esm3","5.3.5-1ubuntu3.8+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:16.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.5-1ubuntu3.fips.3.4.1","5.3.5-1ubuntu3.fips.3.4.2","5.3.5-1ubuntu3.fips.3.8.1","5.3.5-1ubuntu3.fips.3.8.2","5.3.5-1ubuntu3.fips.3.8.3","5.3.5-1ubuntu3.fips.3.8.6","5.3.5-1ubuntu3.fips.3.8.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:16.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.5-1ubuntu3.fips.3.1","5.3.5-1ubuntu3.fips.3.2","5.3.5-1ubuntu3.fips.3.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.5.1-4ubuntu2","5.5.1-4ubuntu3","5.6.1-2ubuntu1","5.6.1-2ubuntu2","5.6.1-2ubuntu3","5.6.1-2ubuntu4","5.6.2-1ubuntu2","5.6.2-1ubuntu2.2","5.6.2-1ubuntu2.3","5.6.2-1ubuntu2.4","5.6.2-1ubuntu2.5","5.6.2-1ubuntu2.6","5.6.2-1ubuntu2.7","5.6.2-1ubuntu2.8","5.6.2-1ubuntu2.9","5.6.2-1ubuntu2.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:18.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.2-1ubuntu2.fips.2.5.1","5.6.2-1ubuntu2.fips.2.7.1","5.6.2-1ubuntu2.fips.2.7.2","5.6.2-1ubuntu2.fips.2.8.1","5.6.2-1ubuntu2.fips.2.9","5.6.2-1ubuntu2.fips.2.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:18.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.2-1ubuntu2.fips.2.4.2","5.6.2-1ubuntu2.fips.2.5.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.2-1ubuntu3","5.8.1-1ubuntu1","5.8.2-1ubuntu1","5.8.2-1ubuntu2","5.8.2-1ubuntu3","5.8.2-1ubuntu3.1","5.8.2-1ubuntu3.2","5.8.2-1ubuntu3.3","5.8.2-1ubuntu3.4","5.8.2-1ubuntu3.5","5.8.2-1ubuntu3.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:20.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.2-1ubuntu3.fips.3.1.2","5.8.2-1ubuntu3.fips.3.3.1","5.8.2-1ubuntu3.fips.3.4.1","5.8.2-1ubuntu3.fips.3.5","5.8.2-1ubuntu3.fips.3.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS:20.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.2-1ubuntu3.fips.3.1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5-2ubuntu2.7"}]}],"versions":["5.9.1-1ubuntu3","5.9.1-1ubuntu3.1","5.9.4-1ubuntu1","5.9.4-1ubuntu2","5.9.4-1ubuntu3","5.9.4-1ubuntu4","5.9.5-2ubuntu1","5.9.5-2ubuntu2","5.9.5-2ubuntu2.1","5.9.5-2ubuntu2.2","5.9.5-2ubuntu2.3","5.9.5-2ubuntu2.4","5.9.5-2ubuntu2.5","5.9.5-2ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.5-2ubuntu2.1+Fips1","5.9.5-2ubuntu2.2+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5-2ubuntu2.7+Fips1"}]}],"versions":["5.9.5-2ubuntu2.1+Fips1","5.9.5-2ubuntu2.2+Fips1","5.9.5-2ubuntu2.3+Fips1","5.9.5-2ubuntu2.4+Fips1","5.9.5-2ubuntu2.5+Fips1","5.9.5-2ubuntu2.6+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.13-2ubuntu4.24.04.4"}]}],"versions":["5.9.11-1ubuntu1","5.9.11-1ubuntu2","5.9.12-1ubuntu1","5.9.13-2ubuntu1","5.9.13-2ubuntu3","5.9.13-2ubuntu4","5.9.13-2ubuntu4.24.04.1","5.9.13-2ubuntu4.24.04.2","5.9.13-2ubuntu4.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1-6ubuntu4.4"}]}],"versions":["5.9.13-2ubuntu4","5.9.13-2ubuntu5","6.0.1-6ubuntu2","6.0.1-6ubuntu4","6.0.1-6ubuntu4.1","6.0.1-6ubuntu4.2","6.0.1-6ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.4-1ubuntu3.1"}]}],"versions":["6.0.1-6ubuntu4","6.0.1-6ubuntu5","6.0.4-1ubuntu1","6.0.4-1ubuntu2","6.0.4-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.5-2ubuntu2.7"}]}],"versions":["5.9.1-1ubuntu3","5.9.1-1ubuntu3.1","5.9.4-1ubuntu1","5.9.4-1ubuntu2","5.9.4-1ubuntu3","5.9.4-1ubuntu4","5.9.5-2ubuntu1","5.9.5-2ubuntu2","5.9.5-2ubuntu2.1","5.9.5-2ubuntu2.2","5.9.5-2ubuntu2.3","5.9.5-2ubuntu2.4","5.9.5-2ubuntu2.5","5.9.5-2ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.13-2ubuntu4.24.04.4"}]}],"versions":["5.9.11-1ubuntu1","5.9.11-1ubuntu2","5.9.12-1ubuntu1","5.9.13-2ubuntu1","5.9.13-2ubuntu3","5.9.13-2ubuntu4","5.9.13-2ubuntu4.24.04.1","5.9.13-2ubuntu4.24.04.2","5.9.13-2ubuntu4.24.04.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.1-6ubuntu4.4"}]}],"versions":["5.9.13-2ubuntu4","5.9.13-2ubuntu5","6.0.1-6ubuntu2","6.0.1-6ubuntu4","6.0.1-6ubuntu4.1","6.0.1-6ubuntu4.2","6.0.1-6ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.4-1ubuntu3.1"}]}],"versions":["6.0.1-6ubuntu4","6.0.1-6ubuntu5","6.0.4-1ubuntu1","6.0.4-1ubuntu2","6.0.4-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.7-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"strongswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.6-160000.2.1"}]}]}],"products":[{"vendor":"strongswan","product":"strongswan"}],"references":[{"url":"https://www.strongswan.org/download.html","tags":["web"]},{"url":"https://github.com/strongswan/strongswan/releases/tag/6.0.7","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47895","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-55p5-7gvc-767j"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-47895","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47895.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-47895","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0490.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35413","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00137.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8407-1","tags":["advisory"]},{"url":"https://www.strongswan.org/blog/2026/06/08/strongswan-vulnerability-(cve-2026-47895).html","tags":["web","report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00246.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/72R2725DIUVMEB7TOVID7XNHTPDC3UIH/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00398.html","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-8789-1","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622168-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266360","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47895","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262312-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261705","tags":["report"]},{"url":"https://bugzilla.suse.com/1261706","tags":["report"]},{"url":"https://bugzilla.suse.com/1261708","tags":["report"]},{"url":"https://bugzilla.suse.com/1261712","tags":["report"]},{"url":"https://bugzilla.suse.com/1261717","tags":["report"]},{"url":"https://bugzilla.suse.com/1261718","tags":["report"]},{"url":"https://bugzilla.suse.com/1261720","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35334","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262459-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264115-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1276533","tags":["report"]},{"url":"https://bugzilla.suse.com/1276534","tags":["report"]},{"url":"https://bugzilla.suse.com/1276536","tags":["report"]},{"url":"https://bugzilla.suse.com/1276539","tags":["report"]},{"url":"https://bugzilla.suse.com/1276540","tags":["report"]},{"url":"https://bugzilla.suse.com/1276541","tags":["report"]},{"url":"https://bugzilla.suse.com/1276543","tags":["report"]},{"url":"https://bugzilla.suse.com/1276544","tags":["report"]},{"url":"https://bugzilla.suse.com/1276548","tags":["report"]},{"url":"https://bugzilla.suse.com/1276549","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-78135","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-47895","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47895","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-47895","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","status":"published","published":"2026-08-22T00:00:00Z","modified":"2026-08-24T13:01:23.595Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-64602","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","status":"published","published":"2026-08-22T00:00:00Z","modified":"2026-08-24T13:01:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:35.296422Z"}],"ghsa":[{"id":"GHSA-55p5-7gvc-767j","title":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that...","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","status":"published","published":"2026-08-23T00:30:21Z","modified":"2026-08-23T00:30:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:10:51.608425Z"}],"nvd":[{"id":"CVE-2026-47895","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","status":"published","published":"2026-08-22T22:16:28.153Z","modified":"2026-10-14T13:10:00.187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T14:12:41.018848Z"}],"osv":[{"id":"ALPINE-CVE-2026-47895","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","status":"published","published":"2026-08-22T22:16:28.153Z","modified":"2026-10-01T02:17:49.316682659Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"CVE-2026-47895","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","status":"published","published":"2026-08-22T00:00:00Z","modified":"2026-10-28T02:30:51.891825261Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-415"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"DEBIAN-CVE-2026-47895","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","status":"published","published":"2026-08-22T22:16:28.153Z","modified":"2026-10-15T09:47:32.132259981Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"UBUNTU-CVE-2026-47895","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","status":"published","published":"2026-06-08T12:00:00Z","modified":"2026-10-05T19:22:15.905930455Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"AZL-97377","title":"CVE-2026-47895 affecting package strongswan for versions less than 5.9.14-10","description":"In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.","status":"published","published":"2026-08-22T22:16:28Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"MGASA-2026-0490","title":"Updated strongswan packages fix security vulnerabilities","description":"Please see the links for aditional information about the\nvulnerabilities.\n","status":"published","published":"2026-10-12T18:47:12Z","modified":"2026-10-12T19:00:44.442913054Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11005-1","title":"strongswan-6.0.7-1.1 on GA media","description":"These are all security issues fixed in the strongswan-6.0.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-11T00:00:00Z","modified":"2026-06-12T08:45:08.570962998Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21092-1","title":"Security update for strongswan","description":"This update for strongswan fixes the following issue\n\n- CVE-2026-47895: Double-Free When Destroying Certain Cloned Identities (bsc#1266360).\n","status":"published","published":"2026-06-18T21:08:21Z","modified":"2026-06-30T18:24:40.536555944Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22168-1","title":"Security update for strongswan","description":"This update for strongswan fixes the following issue\n\n- CVE-2026-47895: Double-Free When Destroying Certain Cloned Identities (bsc#1266360).\n","status":"published","published":"2026-06-18T21:12:33Z","modified":"2026-06-24T18:24:17.957917447Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2312-1","title":"Security update for strongswan","description":"This update for strongswan fixes the following issue\n\n- CVE-2026-47895: double-free when destroying certain cloned identities (bsc#1266360).\n","status":"published","published":"2026-06-09T12:49:33Z","modified":"2026-06-10T18:24:11.993064728Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:2368-1","title":"Security update for strongswan","description":"This update for strongswan fixes the following issues\n\n- CVE-2026-35328: infinite loop when handling supported versions TLS extension (bsc#1261712).\n- CVE-2026-35329: null pointer dereference when processing padding in PKCS#7 (bsc#1261717).\n- CVE-2026-35330: integer underflow when handling EAP-SIM/AKA attributes (bsc#1261705).\n- CVE-2026-35331: accepting certificates violating name constraints (bsc#1261718).\n- CVE-2026-35332: null pointer dereference when handling ECDH public value in TLS (bsc#1261708).\n- CVE-2026-35333: integer underflow when handling RADIUS attributes (bsc#1261706).\n- CVE-2026-35334: possible null pointer dereference in RSA decryption (bsc#1261720).\n- CVE-2026-47895: double-free when destroying certain cloned identities (bsc#1266360).\n","status":"published","published":"2026-06-11T12:21:56Z","modified":"2026-06-12T08:45:05.811384536Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:2459-1","title":"Security update for strongswan","description":"This update for strongswan fixes the following issues\n\n- CVE-2026-35328: infinite loop when handling supported versions TLS extension (bsc#1261712).\n- CVE-2026-35329: null pointer dereference when processing padding in PKCS#7 (bsc#1261717).\n- CVE-2026-35330: integer underflow when handling EAP-SIM/AKA attributes (bsc#1261705).\n- CVE-2026-35331: accepting certificates violating name constraints (bsc#1261718).\n- CVE-2026-35332: null pointer dereference when handling ECDH public value in TLS (bsc#1261708).\n- CVE-2026-35333: integer underflow when handling RADIUS attributes (bsc#1261706).\n- CVE-2026-35334: possible null pointer dereference in RSA decryption (bsc#1261720).\n- CVE-2026-47895: double-free when destroying certain cloned identities (bsc#1266360).\n","status":"published","published":"2026-06-18T16:40:02Z","modified":"2026-06-20T08:45:05.233836559Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4115-1","title":"Security update for strongswan","description":"This update for strongswan fixes the following issues:\n\n- CVE-2026-47895: Double-Free When Destroying Certain Cloned Identities (bsc#1266360).\n- CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).\n- CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).\n- CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).\n- CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).\n- CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).\n- CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).\n- CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).\n- CVE-2026-78132: Infinite Loop When Parsing Attribute Certificates (bsc#1276544).\n- CVE-2026-78134: Missing Inner EAP Method Authentication Details (bsc#1276548).\n- CVE-2026-78135: Creation of a Child SA Pre-Authentication (bsc#1276549).\n","status":"published","published":"2026-09-09T16:21:56Z","modified":"2026-09-14T18:23:14.186754184Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8407-1","title":"strongswan vulnerability","description":"Elliott Childre discovered that strongSwan incorrectly handled the cloning\nof certain identities. A remote attacker could use this issue to cause\nstrongSwan to crash, resulting in a denial of service, or possibly execute\narbitrary code.","status":"published","published":"2026-06-08T17:28:38Z","modified":"2026-08-24T10:00:13.887366871Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}