Release strongSwan 6.1.0 · strongswan/strongswan · GitHub

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2026-78135Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass
• CVE-2026-78130strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser
• CVE-2026-78123strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin
• CVE-2026-78126strongSwan 4.1.10 through 6.0.7 allows a NULL pointer dereference in the eap-aka plugin
• CVE-2026-78132strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax
• CVE-2026-78124strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after its effective lifetime
• CVE-2026-78131strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser
• CVE-2026-78127libcharon in strongSwan 4.1.2 through 6.0.7 has a missing release of memory after its effective lifetime in the IKE message parser
• CVE-2026-78133libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling
• CVE-2026-78129strongSwan 4.6.2 through 6.0.7 has an infinite loop in PKCS#5 decryption
• CVE-2026-78134strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity

Source and provenance

Original title: Release strongSwan 6.1.0 · strongswan/strongswan · GitHub. Captured 26 Sept 2026, 16:54 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.