# CVE-2026-78127: strongSwan libcharon memory leak in IKE message logging

Source: https://junglewise.ai/threats/cve-2026-78127-strongswan-libcharon-memory-leak-in-ike-message-logging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78127 · Severity: low · CVSS 3.7 · Published 2026-09-11

strongSwan is an open-source VPN implementation widely deployed in corporate networks, routers, and embedded systems to manage IPsec connections. A memory leak in the IKE message logging functionality allows an attacker to send specially crafted VPN negotiation messages that leak memory with each message processed. By sending enough messages, an attacker can exhaust system memory and cause the VPN service to stop responding, disrupting secure communications for all users relying on that VPN gateway.

Technologies: [strongSwan](https://junglewise.ai/threats/technologies/strongswan). Vendors: [strongSwan](https://junglewise.ai/threats/vendors/strongswan).

## Quick answers

**Is CVE-2026-78127 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78127 being exploited in the wild.

**How severe is CVE-2026-78127?** Low severity, with a CVSS score of 3.7, published 11 September 2026.

**Which products and versions are affected?** strongSwan 4.1.2 through 6.0.7.

**Is there a fix for CVE-2026-78127?** A patch was published on 2026-09-07: Fixed in strongSwan 6.1.0; patches available for older versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78127 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78127?** Check whether you run strongSwan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource exhaustion flaw (CWE-400) in the message_t::parse_body() and get_string() functions of libcharon. When converting IKE messages to string representation for logging, the code obtains payload enumerators via create_payload_enumerator() but fails to destroy them if the fixed-size stack buffer is exhausted during snprintf() operations. An attacker can craft messages with many unknown payloads or configuration attributes whose string representation exceeds the buffer, triggering the early return without enumerator cleanup. This leaks up to 80 bytes per message (40 bytes in versions prior to 4.4.1). The vulnerability requires network reachability to the IKE service but no authentication. Accumulated memory leaks eventually cause denial of service through memory exhaustion. The issue is fixed in strongSwan 6.1.0 and patches are available for older versions.

## Affected products

- strongSwan strongSwan 4.1.2 through 6.0.7

## Timeline

- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in strongSwan 6.1.0; patches available for older versions

## References

- [https://github.com/strongswan/strongswan/releases/tag/6.1.0](https://github.com/strongswan/strongswan/releases/tag/6.1.0)
- [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78127).html](https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78127).html)

## Related threats

- [strongSwan libcharon authentication bypass in IKEv2 CREATE_CHILD_SA handling](https://junglewise.ai/threats/cve-2026-78135-strongswan-libcharon-authentication-bypass-in-ikev2-create-child)
- [strongSwan incorrect identity binding in EAP-PEAP and EAP-TTLS](https://junglewise.ai/threats/cve-2026-78134-strongswan-incorrect-identity-binding-in-eap-peap-and-eap-ttls)
- [strongSwan libcharon use-after-free in IKEv2 rekeying collision handling](https://junglewise.ai/threats/cve-2026-78133-strongswan-libcharon-use-after-free-in-ikev2-rekeying-collision)
- [strongSwan x509 plugin infinite loop in ietfAttrSyntax parsing](https://junglewise.ai/threats/cve-2026-78132-strongswan-x509-plugin-infinite-loop-in-ietfattrsyntax-parsing)
- [strongSwan x509 plugin memory leak in attribute certificate parsing](https://junglewise.ai/threats/cve-2026-78131-strongswan-x509-plugin-memory-leak-in-attribute-certificate)