Executive brief
strongSwan is an open-source IPsec implementation used to establish secure VPN connections and encrypted communications. A flaw in its handling of encrypted certificate containers allows a remote attacker to send a crafted message that causes the IKE daemon to consume CPU indefinitely or crash, disrupting VPN services and potentially affecting business continuity for organizations relying on this technology for secure remote access.
Technical details
The vulnerability is an infinite loop / denial of service in the PKCS#5 implementation within libstrongswan. The root cause is missing validation of the iteration count, key length, and salt length parameters when decrypting PKCS#5-encrypted structures (e.g., PKCS#7 containers). An attacker can craft an encrypted PKCS#7 container with an astronomically large iteration count that, when processed, causes the decryption loop to block indefinitely. Additionally, an excessively large key length parsed as a 64-bit value without bounds can cause a stack buffer overflow via chunk_alloca(), leading to a crash. Since strongSwan 5.1.0, the pkcs7 plugin automatically attempts to decrypt containers without a password (to handle password-less PKCS#12 containers), making remote exploitation possible via IKEv1 certificate payloads. The attack is unauthenticated and requires only network reachability to an IKE daemon with IKEv1 enabled. Patch is available in strongSwan 6.1.0 released on 2026-09-07.
Affected products
- strongSwan strongSwan 4.6.2 through 6.0.7
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in strongSwan 6.1.0