CVE-2026-25075: strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow
Vulnerability summary
CVE-2026-25075 is a high (CVSS 8.7) Integer Underflow (Wrap or Wraparound) vulnerability in strongswan. EPSS estimates a 1.05% chance of exploitation in the next 30 days, higher than 64.4% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 23-03-2026PublishedVulnerability first disclosed.
- 14-07-2026Last modifiedVulnerability information updated.
Description
strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate AVP length fields before subtraction to trigger excessive memory allocation or NULL pointer dereference, crashing the charon IKE daemon.
CVSS metrics
7 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.05%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
Increase +0.04 pp
From 1.01% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (strongswan.org)
Maturity: unknown
Exploit Reference (y637f9qq2x.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
- CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse15 products
- strongswan&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 5.9.11-150400.19.26.1
- strongswan&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 5.9.11-150400.19.26.1
- strongswan&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 5.9.11-150500.5.14.1
- strongswan&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 5.9.11-150500.5.14.1
- strongswan&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 5.9.14-150700.3.9.1
Opensuse2 products
- strongswan&distro=openSUSE Leap 15.6< 5.9.12-150600.3.11.1
- strongswan&distro=openSUSE Tumbleweed< 6.0.5-1.1
Debian1 product
- strongswan< 6.0.5-1 | < 5.9.8-5+deb12u3 | < 6.0.1-6+deb13u4 | < 5.9.1-1+deb11u6
Mageia1 product
- strongswan< 5.9.14-1.2.mga9
Strongswan1 product
- strongswan≥ 4.5.0, < 6.0.5
Ubuntu1 product
- strongswanAll versions (No fix recorded) | < 5.9.5-2ubuntu2.5+Fips1 | < 5.9.5-2ubuntu2.5 | < 5.9.13-2ubuntu4.24.04.2 | < 6.0.1-6ubuntu4.2
6 vendors · 21 products
References
22 links- www.strongswan.org/blog/2026/03/23/strongswan-vulnerability-(cve-2026-25075).htmlVendor AdvisoryExploit
- www.vulncheck.com/advisories/strongswan-eap-ttls-avp-parsing-integer-underflowThird Party Advisory
