CVE-2026-78133: 
strongSwan vulnerability analysis and mitigation

CVE-2026-78133 is a use-after-free vulnerability in libcharon, the core IKE daemon library of strongSwan, affecting versions 6.0.0 through 6.0.7. The flaw exists in IKEv2 rekeying collision handling and can potentially lead to remote code execution. It was disclosed on September 7, 2026, via the strongSwan project blog, with the GitHub Advisory Database and NVD publishing on September 11, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, strongSwan Release).

The vulnerability is classified as CWE-416 (Use After Free) and resides in libcharon's handling of IKEv2 rekeying collision scenarios — situations where both IKE peers simultaneously initiate rekeying of the same IKE SA. A race condition in this collision resolution logic can result in a memory region being freed and subsequently accessed, leading to memory corruption. Exploitation requires network access and low-level authentication (authenticated IKE peer), and the attack complexity is rated High, indicating that specific timing or conditions must be met to trigger the collision. The fix in strongSwan 6.1.0 includes ensuring nonces of unequal lengths are correctly compared when resolving rekey collisions (commit 00830dd) (strongSwan Release, Github Advisory).

Successful exploitation of this vulnerability can result in arbitrary code execution on the affected strongSwan host, with full confidentiality, integrity, and availability impact. An attacker who can trigger the use-after-free condition may crash the charon IKE daemon (disrupting VPN connectivity) or, in a more sophisticated attack, achieve remote code execution running as the strongSwan service account. Given that strongSwan is widely deployed as a VPN gateway, compromise could expose encrypted tunnel traffic, allow lateral movement into protected network segments, or enable interception of VPN-protected communications (Github Advisory, strongSwan Release).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The NVD SSVC assessment confirms exploitation is currently "none" and the vulnerability is not automatable due to the High attack complexity requirement. The EPSS score is approximately 0.42%, placing it in the 37th percentile for exploitation likelihood within 30 days. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing strongSwan VPN gateways running versions 6.0.0–6.0.7 using network scanning tools (e.g., Shodan, Censys) or by probing IKEv2 endpoints on UDP port 500/4500.
2. Establish authenticated IKE session: Obtain or compromise valid IKE credentials (pre-shared key, certificate, or EAP credentials) to establish a legitimate IKEv2 SA with the target gateway, satisfying the low-privilege authentication precondition.
3. Trigger simultaneous rekeying collision: Initiate an IKEv2 rekeying operation from the attacker-controlled peer while engineering the target to simultaneously initiate its own rekey of the same IKE SA — this requires precise timing or a modified IKE client to send CREATE_CHILD_SA requests concurrently.
4. Exploit use-after-free: The collision handling code in libcharon frees a memory object during collision resolution but retains a dangling pointer; the attacker's crafted rekeying messages manipulate heap layout to control the freed memory region.
5. Achieve code execution or crash: Depending on heap state, the attacker either crashes the charon daemon (denial of service) or achieves arbitrary code execution in the context of the strongSwan process (strongSwan Release, Github Advisory).

• Network: Unusual or repeated IKEv2 CREATE_CHILD_SA exchanges on UDP port 500/4500 from the same peer in rapid succession; simultaneous rekeying attempts from a single authenticated peer.
• Logs: strongSwan charon daemon crash logs or unexpected restarts in /var/log/syslog or journalctl -u strongswan; IKE SA state inconsistencies logged in charon.log during rekeying events.
• Process: Unexpected termination of the charon process; core dump files generated by the charon daemon in the working directory or /var/crash/.
• File System: Presence of core dump files (e.g., core, charon.core) in strongSwan runtime directories indicating a daemon crash.

The primary remediation is to upgrade strongSwan to version 6.1.0 or later, which contains the fix for CVE-2026-78133 (strongSwan Release). Patches are also available via Debian, Ubuntu (USN-8789-1), openSUSE, and FreeBSD package repositories. For systems that cannot be immediately patched, restrict network access to the IKEv2 service (UDP 500/4500) to trusted peers only, and limit the pool of authenticated users who can initiate rekeying operations to reduce the attack surface.

The strongSwan project disclosed the vulnerability proactively via their official blog on September 7, 2026, ahead of the NVD publication, as part of a coordinated release of multiple CVEs fixed in version 6.1.0. Downstream Linux distributions including Debian, Ubuntu, and openSUSE issued security advisories and updated packages promptly following the disclosure. Security scanning vendors Tenable (Nessus) and Qualys released detection plugins shortly after the advisory was published.