Executive brief
strongSwan is a widely-deployed VPN and IPsec implementation used to secure network communications. libcharon, its core IKE daemon, contains a use-after-free vulnerability in how it handles simultaneous rekeying requests from both peers. An authenticated attacker who can initiate or intercept multi-key-exchange rekey collisions can trigger memory corruption, potentially leading to denial of service or remote code execution on VPN endpoints and gateways.
Technical details
The vulnerability is a use-after-free in libcharon's IKEv2 multi-key-exchange (multi-KE) rekeying collision handling. When both peers simultaneously request rekeying of the same IKE or Child SA, libcharon maintains a reference from the active (initiating) task to the passive (responding) task to resolve the collision via nonce comparison. With multi-KE rekeys, if the passive task fails (e.g., due to a missing or invalid KE payload that an attacker can control) before completing, the task manager destroys it while the active task still holds a dangling pointer. When the collision is later resolved, the active task dereferences this freed memory for an indirect function call, potentially leading to RCE. The attacker must be authenticated to the VPN and successfully manipulate the multi-KE exchange timing and payloads. Versions 6.0.0 through 6.0.7 are affected; strongSwan 6.1.0 and patched versions of older releases fix this issue.
Affected products
- strongSwan strongSwan 6.0.0 through 6.0.7
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fixed in strongSwan 6.1.0