CVE-2026-25075: 
strongSwan vulnerability analysis and mitigation

CVE-2026-25075 is an integer underflow vulnerability in the EAP-TTLS AVP parser of strongSwan that allows unauthenticated remote attackers to crash the charon IKE daemon via crafted AVP data with invalid length fields during IKEv2 authentication. It affects strongSwan versions 4.5.0 through 6.0.4 (prior to 6.0.5), representing a flaw present for approximately 15 years. The vulnerability was disclosed on March 23, 2026, with a patch released on March 25, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (Red Hat Advisory, VulnCheck).

The root cause is an integer underflow (CWE-191) in the EAP-TTLS AVP parser, where AVP length fields are not validated before subtraction operations, which can also lead to a NULL pointer dereference (CWE-476). During IKEv2 authentication, an attacker sends crafted AVP data with invalid (e.g., too-small) length values; the parser subtracts from these values without bounds checking, causing the result to wrap around to a very large number, triggering excessive memory allocation or a NULL pointer dereference that crashes the charon IKE daemon. No authentication or user interaction is required — the attack is fully network-accessible with low complexity. BishopFox published a technical write-up and a non-destructive detection tool for this vulnerability (BishopFox Blog, BishopFox PoC).

Successful exploitation results in a denial of service by crashing the charon IKE daemon, which terminates all active and pending VPN connections managed by strongSwan. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Organizations relying on strongSwan for VPN gateway services, remote access, or site-to-site connectivity could experience complete VPN outages, potentially disrupting business operations or leaving network segments inaccessible (Red Hat Advisory, BishopFox Blog).

No confirmed weaponized exploit exists; BishopFox released a Python-based detection tool that non-destructively probes whether a server is vulnerable by observing its response to malformed AVP data, without triggering the actual crash (BishopFox PoC). There is no evidence of in-the-wild exploitation or threat actor attribution as of the time of reporting. The EPSS score is approximately 0.152%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available in Nessus and Qualys scanners (Red Hat Advisory).

1. Reconnaissance: Identify internet-facing strongSwan IKEv2 endpoints (UDP port 500/4500) using tools like Shodan or Censys, filtering for versions 4.5.0 through 6.0.4.
2. Initiate IKEv2 authentication: Begin an IKEv2 handshake with the target server, reaching the EAP-TTLS authentication phase where AVP data is exchanged.
3. Craft malformed AVP data: Construct an EAP-TTLS AVP packet with an invalid (undersized) length field value — specifically a value that, when subtracted from in the parser, causes an integer underflow (e.g., a length field of 0 or 1 where a larger value is expected).
4. Send crafted packet: Transmit the malformed AVP packet to the target during the IKEv2 EAP-TTLS negotiation phase.
5. Trigger crash: The charon daemon's AVP parser performs an unchecked subtraction on the invalid length field, resulting in either a massive memory allocation attempt or a NULL pointer dereference, crashing the daemon and terminating all VPN sessions (BishopFox Blog, BishopFox PoC).

• Network: Unexpected or repeated IKEv2 authentication attempts (UDP 500/4500) from unknown or untrusted sources; EAP-TTLS negotiation traffic containing malformed AVP length fields.
• Logs: Sudden termination entries for the charon daemon in system logs (e.g., /var/log/syslog, /var/log/daemon.log, or journald); strongSwan log entries showing EAP-TTLS parsing errors or segmentation faults immediately preceding a daemon crash.
• Process: Unexpected termination or restart of the charon process; core dump files generated by the charon daemon in the strongSwan working directory.
• File System: Core dump files (e.g., core, charon.core) in /var/run/strongswan/ or the configured core dump directory, timestamped around the time of suspicious IKEv2 traffic (BishopFox Blog).

The primary remediation is to upgrade strongSwan to version 6.0.5 or later, which validates AVP length fields before performing subtraction operations (strongSwan Blog). Linux distribution patches are available for Debian (DLA-4512-1), openSUSE, SUSE, Mageia, and Fedora. As a network-level workaround, restrict IKEv2 authentication attempts (UDP 500/4500) to trusted IP ranges using firewall rules to reduce exposure. Additionally, monitor for unexpected charon daemon crashes and unusual IKEv2 authentication traffic patterns as an interim detection measure (Red Hat Advisory).

BishopFox published a detailed technical blog post and released a non-destructive detection tool on GitHub, which received attention from the security community (BishopFox Blog). The vulnerability was discussed on Reddit's r/blueteamsec and noted in the Risky Biz newsletter, reflecting moderate community interest given its DoS-only impact and the 15-year age of the affected code. Coverage appeared in HackRead, PrivacySavvy, and The Hacker News weekly recap, with several outlets highlighting the long-standing nature of the flaw (HackRead).