ST
Product
strongSwan
51
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 18Medium 6Low 4
Watch
Add strongSwan to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-62291 | 8.1 | Jan 16 | In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause an integer underflow… Affected: 4.2.12 before 6.0.3 |
| CVE-2026-78133 | 7.5 | Sep 11 | libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling Affected: 6.0.0 before 6.1.0 |
| CVE-2026-78132 | 7.5 | Sep 11 | strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax Affected: 5.1.3 before 6.1.0 |
| CVE-2026-78130 | 7.5 | Sep 11 | strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser Affected: 4.2.0 before 6.1.0 |
| CVE-2026-47895 | 7.5 | Aug 22 | In strongSwan before 6.0.7, identity parsing/cloning is mishandled Affected: 4.3.3 before 6.0.7 |
| CVE-2026-25075 | 7.5 | Mar 23 | strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow Affected: 4.5.0 before 6.0.5 |
| CVE-2022-40617 | 7.5 | Oct 31 | strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a crafted end-entity (and intermediate CA) certificate that… Affected: before 5.9.8 |
| CVE-2021-41991 | 7.5 | Oct 18 | The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certificates to fill the cache and later… Affected: 4.2.10 before 5.9.4 |
| CVE-2021-41990 | 7.5 | Oct 18 | The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature Affected: 5.6.1 before 5.9.4 |
| CVE-2018-17540 | 7.5 | Oct 3 | The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate Affected: before 5.7.1 |
| CVE-2018-16152 | 7.5 | Sep 26 | In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data… Affected: 4.0.0 through 4.6.4; 5.0.0 before 5.7.0 |
| CVE-2018-16151 | 7.5 | Sep 26 | In verify_emsa_pkcs1_signature() in gmp_rsa_public_key.c in the gmp plugin in strongSwan 4.x and 5.x before 5.7.0, the RSA implementation based on GMP does not reject excess data… Affected: 4.0.0 through 4.6.4; 5.0.0 before 5.7.0 |
| CVE-2018-10811 | 7.5 | Jun 19 | strongSwan 5.6.0 and older allows Remote Denial of Service because of Missing Initialization of a Variable Affected: 5.0.1 before 5.6.3 |
| CVE-2017-11185 | 7.5 | Aug 18 | The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature Affected: through 5.5.3 |
| CVE-2017-9023 | 7.5 | Jun 8 | The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allows remote attackers to cause a denial of service (infinite… Affected: through 5.5.2 |
| CVE-2017-9022 | 7.5 | Jun 8 | The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which allows remote peers to cause a denial of service (floating… Affected: through 5.5.2 |
| CVE-2026-78135 | 7.3 | Sep 11 | libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine Affected: 5.9.7 before 6.1.0 |
| CVE-2026-78134 | 7.1 | Sep 11 | strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity Affected: 4.5.0 before 6.1.0 |
Showing 18