CVE-2026-25075

EUVD-2026-14477

23.03.2026, 19:16

strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate AVP length fields before subtraction to trigger excessive memory allocation or NULL pointer dereference, crashing the charon IKE daemon.

Wrap or Wraparound

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
VulnCheck	CNA	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Affected Products (NVD)

Vendor	Product	Version
strongswan	strongswan	4.5.0 ≤ 𝑥 < 6.0.5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

strongswan

bookworm	vulnerable
bookworm (security)	5.9.8-5+deb12u3 fixed
bullseye	vulnerable
bullseye (security)	5.9.1-1+deb11u6 fixed
forky	6.0.5-1 fixed
sid	6.0.5-1 fixed
trixie	vulnerable
trixie (security)	6.0.1-6+deb13u4 fixed

Ubuntu Releases

Ubuntu Product

Codename

strongswan

bionic	needs-triage
focal	needs-triage
jammy	Fixed 5.9.5-2ubuntu2.5 released
noble	Fixed 5.9.13-2ubuntu4.24.04.2 released
questing	Fixed 6.0.1-6ubuntu4.2 released
trusty	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-191 - Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

References

https://www.strongswan.org/blog/2026/03/23/strongswan-6.0.5-released.html

https://www.strongswan.org/blog/2026/03/23/strongswan-vulnerability-(cve-2026-25075).html

https://www.vulncheck.com/advisories/strongswan-eap-ttls-avp-parsing-integer-underflow

https://lists.debian.org/debian-lts-announce/2026/03/msg00016.html