Is CVE-2026-25075 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25075 being exploited in the wild.

How severe is CVE-2026-25075?

High severity, with a CVSS score of 7.5, published 23 March 2026.

Which products and versions are affected?

strongSwan 4.5.0 prior to 6.0.5.

Is there a fix for CVE-2026-25075?

A patch was published on 2026-03-23: strongSwan 6.0.5 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25075 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25075?

Check whether you run strongSwan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25075: strongSwan integer underflow in EAP-TTLS AVP parser

CVE-2026-25075 · Severity: high · CVSS 7.5 · Published 2026-03-23

strongSwan is a widely used open-source software for creating secure VPN connections. A flaw in how it handles certain authentication messages allows an unauthenticated remote attacker to crash the VPN service. This results in a denial of service, preventing users from connecting to the network and disrupting secure communications.

Technologies: strongSwan. Vendors: strongSwan.

Quick answers

Is CVE-2026-25075 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25075 being exploited in the wild.
How severe is CVE-2026-25075?: High severity, with a CVSS score of 7.5, published 23 March 2026.
Which products and versions are affected?: strongSwan 4.5.0 prior to 6.0.5.
Is there a fix for CVE-2026-25075?: A patch was published on 2026-03-23: strongSwan 6.0.5 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25075 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25075?: Check whether you run strongSwan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer underflow vulnerability exists in the eap-ttls plugin of strongSwan when processing Attribute-Value Pairs (AVPs). The parser fails to validate that the 3-byte length field in the AVP header is at least 8 bytes (the size of the header itself) before subtracting 8 to determine the payload length. By sending a crafted AVP with a length between 0 and 7, an unauthenticated remote attacker triggers a 32-bit integer underflow. This leads to an extremely large memory allocation attempt (~4 GiB) via chunk_alloc(). Because the software does not verify if the allocation succeeded before attempting to write to the resulting buffer, a NULL pointer dereference occurs, crashing the charon IKE daemon. The vulnerability is reachable during the IKEv2 authentication phase before the client has authenticated. Fixed in version 6.0.5.

Affected products

strongSwan strongSwan 4.5.0 prior to 6.0.5

Timeline

2026-03-23: disclosed: Vulnerability reported by Kazuma Matsumoto
2026-03-23: patched: strongSwan 6.0.5 released with fix
2026-03-23: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.