CVE-2026-78135
CVE-2026-78135
This page contains facts from public vulnerability sources. Check the original advisory before updating.
libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.
CVSS 5.6 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
strongswan
- Versions
- ≥ 5.9.7, < 6.1.0: Affected (semver)
Update to 6.1.0
strongswan Debian:12
- Versions
- 5.9.11-1
- 5.9.11-2
- 5.9.12-1
- 5.9.13-1
- 5.9.13-2
- 5.9.8-5
- 5.9.8-5+deb12u1
- 5.9.8-5+deb12u2
- 5.9.8-5+deb12u3
- 5.9.8-5+deb12u4
- 5.9.8-5+deb12u5
- 6.0.0-1
- 6.0.0-2
- 6.0.1-1
- 6.0.1-2
- 6.0.1-3
- 6.0.1-4
- 6.0.1-5
- 6.0.1-6
- 6.0.2-1
- 6.0.3-1
- 6.0.4-1
- 6.0.5-1
- 6.0.6-1
- 6.0.7-1
- 6.1.0-1
- 6.1.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Debian:13
- Versions
- 6.0.1-6
- 6.0.1-6+deb13u1
- 6.0.1-6+deb13u2
- 6.0.1-6+deb13u4
- 6.0.1-6+deb13u5
- 6.0.1-6+deb13u6
- Affected ranges
- ECOSYSTEM: < 6.0.1-6+deb13u7
Update to 6.0.1-6+deb13u7
strongswan Debian:14
- Versions
- 6.0.1-6
- 6.0.2-1
- 6.0.3-1
- 6.0.4-1
- 6.0.5-1
- 6.0.6-1
- 6.0.7-1
- Affected ranges
- ECOSYSTEM: < 6.1.0-1
Update to 6.1.0-1
strongswan Ubuntu:Pro:14.04:LTS
- Versions
- 4.6.4-9
- 5.1.0-2
- 5.1.0-3
- 5.1.1-0ubuntu1
- 5.1.1-0ubuntu2
- 5.1.1-0ubuntu3
- 5.1.1-0ubuntu4
- 5.1.1-0ubuntu5
- 5.1.1-0ubuntu7
- 5.1.1-0ubuntu14
- 5.1.1-0ubuntu17
- 5.1.2~dr3+git20130120-0ubuntu2
- 5.1.2~dr3+git20130120-0ubuntu3
- 5.1.2~rc1-0ubuntu3
- 5.1.2~rc1-0ubuntu4
- 5.1.2~rc2-0ubuntu2
- 5.1.2-0ubuntu1
- 5.1.2-0ubuntu2
- 5.1.2-0ubuntu2.2
- 5.1.2-0ubuntu2.3
- 5.1.2-0ubuntu2.4
- 5.1.2-0ubuntu2.5
- 5.1.2-0ubuntu2.6
- 5.1.2-0ubuntu2.7
- 5.1.2-0ubuntu2.8
- 5.1.2-0ubuntu2.10
- 5.1.2-0ubuntu2.11
- 5.1.2-0ubuntu2.11+esm1
- 5.1.2-0ubuntu2.11+esm2
- 5.1.2-0ubuntu2.11+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:Pro:16.04:LTS
- Versions
- 5.1.2-0ubuntu6
- 5.1.2-0ubuntu7
- 5.1.2-0ubuntu8
- 5.3.5-1ubuntu1
- 5.3.5-1ubuntu2
- 5.3.5-1ubuntu3
- 5.3.5-1ubuntu3.1
- 5.3.5-1ubuntu3.2
- 5.3.5-1ubuntu3.3
- 5.3.5-1ubuntu3.4
- 5.3.5-1ubuntu3.5
- 5.3.5-1ubuntu3.7
- 5.3.5-1ubuntu3.8
- 5.3.5-1ubuntu3.8+esm1
- 5.3.5-1ubuntu3.8+esm2
- 5.3.5-1ubuntu3.8+esm3
- 5.3.5-1ubuntu3.8+esm4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:Pro:FIPS-updates:16.04:LTS
- Versions
- 5.3.5-1ubuntu3.fips.3.4.1
- 5.3.5-1ubuntu3.fips.3.4.2
- 5.3.5-1ubuntu3.fips.3.8.1
- 5.3.5-1ubuntu3.fips.3.8.2
- 5.3.5-1ubuntu3.fips.3.8.3
- 5.3.5-1ubuntu3.fips.3.8.6
- 5.3.5-1ubuntu3.fips.3.8.7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:Pro:FIPS:16.04:LTS
- Versions
- 5.3.5-1ubuntu3.fips.3.1
- 5.3.5-1ubuntu3.fips.3.2
- 5.3.5-1ubuntu3.fips.3.3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:Pro:18.04:LTS
- Versions
- 5.5.1-4ubuntu2
- 5.5.1-4ubuntu3
- 5.6.1-2ubuntu1
- 5.6.1-2ubuntu2
- 5.6.1-2ubuntu3
- 5.6.1-2ubuntu4
- 5.6.2-1ubuntu2
- 5.6.2-1ubuntu2.2
- 5.6.2-1ubuntu2.3
- 5.6.2-1ubuntu2.4
- 5.6.2-1ubuntu2.5
- 5.6.2-1ubuntu2.6
- 5.6.2-1ubuntu2.7
- 5.6.2-1ubuntu2.8
- 5.6.2-1ubuntu2.9
- 5.6.2-1ubuntu2.9+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:Pro:FIPS-updates:18.04:LTS
- Versions
- 5.6.2-1ubuntu2.fips.2.5.1
- 5.6.2-1ubuntu2.fips.2.7.1
- 5.6.2-1ubuntu2.fips.2.7.2
- 5.6.2-1ubuntu2.fips.2.8.1
- 5.6.2-1ubuntu2.fips.2.9
- 5.6.2-1ubuntu2.fips.2.9+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:Pro:FIPS:18.04:LTS
- Versions
- 5.6.2-1ubuntu2.fips.2.4.2
- 5.6.2-1ubuntu2.fips.2.5.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:20.04:LTS
- Versions
- 5.7.2-1ubuntu3
- 5.8.1-1ubuntu1
- 5.8.2-1ubuntu1
- 5.8.2-1ubuntu2
- 5.8.2-1ubuntu3
- 5.8.2-1ubuntu3.1
- 5.8.2-1ubuntu3.2
- 5.8.2-1ubuntu3.3
- 5.8.2-1ubuntu3.4
- 5.8.2-1ubuntu3.5
- 5.8.2-1ubuntu3.6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:Pro:FIPS-updates:20.04:LTS
- Versions
- 5.8.2-1ubuntu3.fips.3.1.2
- 5.8.2-1ubuntu3.fips.3.3.1
- 5.8.2-1ubuntu3.fips.3.4.1
- 5.8.2-1ubuntu3.fips.3.5
- 5.8.2-1ubuntu3.fips.3.6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:Pro:FIPS:20.04:LTS
- Versions
- 5.8.2-1ubuntu3.fips.3.1.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:22.04:LTS
- Versions
- 5.9.1-1ubuntu3
- 5.9.1-1ubuntu3.1
- 5.9.4-1ubuntu1
- 5.9.4-1ubuntu2
- 5.9.4-1ubuntu3
- 5.9.4-1ubuntu4
- 5.9.5-2ubuntu1
- 5.9.5-2ubuntu2
- 5.9.5-2ubuntu2.1
- 5.9.5-2ubuntu2.2
- 5.9.5-2ubuntu2.3
- 5.9.5-2ubuntu2.4
- 5.9.5-2ubuntu2.5
- 5.9.5-2ubuntu2.6
- 5.9.5-2ubuntu2.7
- Affected ranges
- ECOSYSTEM: < 5.9.5-2ubuntu2.8
Update to 5.9.5-2ubuntu2.8
strongswan Ubuntu:Pro:FIPS-preview:22.04:LTS
- Versions
- 5.9.5-2ubuntu2.1+Fips1
- 5.9.5-2ubuntu2.2+Fips1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:Pro:FIPS-updates:22.04:LTS
- Versions
- 5.9.5-2ubuntu2.1+Fips1
- 5.9.5-2ubuntu2.2+Fips1
- 5.9.5-2ubuntu2.3+Fips1
- 5.9.5-2ubuntu2.4+Fips1
- 5.9.5-2ubuntu2.5+Fips1
- 5.9.5-2ubuntu2.6+Fips1
- 5.9.5-2ubuntu2.7+Fips1
- 5.9.5-2ubuntu2.8+Fips1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
strongswan Ubuntu:24.04:LTS
- Versions
- 5.9.11-1ubuntu1
- 5.9.11-1ubuntu2
- 5.9.12-1ubuntu1
- 5.9.13-2ubuntu1
- 5.9.13-2ubuntu3
- 5.9.13-2ubuntu4
- 5.9.13-2ubuntu4.24.04.1
- 5.9.13-2ubuntu4.24.04.2
- 5.9.13-2ubuntu4.24.04.3
- 5.9.13-2ubuntu4.24.04.4
- Affected ranges
- ECOSYSTEM: < 5.9.13-2ubuntu4.24.04.5
Update to 5.9.13-2ubuntu4.24.04.5
strongswan Ubuntu:26.04:LTS
- Versions
- 6.0.1-6ubuntu4
- 6.0.1-6ubuntu5
- 6.0.4-1ubuntu1
- 6.0.4-1ubuntu2
- 6.0.4-1ubuntu3
- 6.0.4-1ubuntu3.1
- Affected ranges
- ECOSYSTEM: < 6.0.4-1ubuntu3.2
Update to 6.0.4-1ubuntu3.2