Blog

Release and vulnerability announcements for strongSwan

strongSwan 6.1.0 Released

We are happy to announce the release of strongSwan 6.1.0, which fixes eleven vulnerabilities, disables IKEv1 by default, adds support for SA migration on Linux, and comes with several other improvements and fixes.

release6.1.x

Eleven Vulnerabilities Fixed

Thanks to improvements in AI-assisted security analysis, the following eleven vulnerabilities were found and fixed. Please refer to the individual advisories for further details.

  • CVE-2026-78123 - Fixed a vulnerability in the openssl plugin related to the processing of PKCS#7 containers that can result in a crash. Affects 5.0.2 and newer.
  • CVE-2026-78124 - Fixed a vulnerability in the openssl plugin related to the enumeration of certificates in PKCS#7 containers that can result in memory leaks. Affects 5.0.2 and newer.
  • CVE-2026-78126 - Fixed a vulnerability in the eap-aka plugin related to processing an unexpected AKA-Synchronization-Failure that can result in a crash. Affects 4.1.10 and newer.
  • CVE-2026-78127 - Fixed a vulnerability in libcharon related to the logging of IKE messages that can result in a denial of service via memory exhaustion. Affects 4.1.2 and newer.
  • CVE-2026-78129 - Fixed a vulnerability in libstrongswan related to the processing of encrypted PKCS#7 containers that can result in a denial of service. Affects 4.6.2 and newer.
  • CVE-2026-78130 - Fixed a vulnerability in the x509 plugin related to the verification of X.509 attribute certificates that can lead to a denial of service. Affects 4.2.0 and newer.
  • CVE-2026-78131 - Fixed a vulnerability in the x509 plugin related to the parsing of identities in X.509 attribute certificates that can lead to a denial of service via memory exhaustion. Affects 4.2.0 and newer.
  • CVE-2026-78132 - Fixed a vulnerability in the x509 plugin related to the parsing of the ietfAttrSyntax ASN.1 type in X.509 attribute certificates that can lead to a denial of service. Affects 5.1.3 and newer.
  • CVE-2026-78133 - Fixed a vulnerability in libcharon related to the handling of IKEv2 rekeying collisions that can result in a use-after-free and potentially remote code execution. Affects 6.0.0 and newer.
  • CVE-2026-78134 - Fixed a vulnerability in the eap-peap and eap-ttls plugins related to the propagation of authentication details from inner EAP methods that can result in incorrect identity binding and potential authorization bypass. Affects 4.5.0 and newer.
  • CVE-2026-78135 - Fixed a vulnerability in libcharon related to the handling of CREATE_CHILD_SA requests on unestablished IKE SAs that can result in the creation of a usable Child SA before authentication completes. Affects 5.9.7 and newer.

IKEv1 Disabled By Default

The IKEv1 protocol is now disabled by default. Support for the protocol will be removed in a future release, likely within the next year (there is no definitive timeline yet).

When building, IKEv1 has to be enabled explicitly via --enable-ikev1. A warning about its impending removal is logged.

In the configuration, version now defaults to 2. If it is set to 0 or 1, a warning is logged when the configuration is loaded.

Support for XFRM_MSG_MIGRATE_STATE

Support for the XFRM_MSG_MIGRATE_STATE message in Linux 7.2 has been added. This allows migrating specific SAs to different IPs (and changing other properties), which enables updating SAs even when the kernel's lockdown feature is set to confidentiality (i.e. we don't get the keys back when we query an SA). As updating IKE SAs is broken on older kernels in that case, we now fall back to rekeying to avoid installing unusable SAs if we detect that the kernel is in lockdown mode.

Removal Of Several Plugins/Components

The following plugins and components were removed: af-alg, android-dns, blowfish, charon-xpc, duplicheck, gcrypt, keychain, led, libfast, manager, medsrv/medcli, padlock, smp, soup, tnc-ifmap, tnccs-11, tnccs-dynamic.

We recommend that they not be enabled when building older releases either.

Other Notable Features and Fixes

  • Removed the retry mechanism from the eap-mschapv2 plugin if the password is incorrect, because it could potentially get exploited for a DoS attack and its usefulness was questionable anyway.
  • CRLs that contain critical issuingDistributionPoint extensions are not silently accepted anymore as the plugins don't support it, which could lead to incorrect validation.
  • The stroke plugin now reports the total number of SAs instead of the number of "up" SAs to avoid an integer underflow if there are more queued initial messages than SAs.
  • charon-tkm now maps proposals to ia and ea identitifers.
  • Simplified X.509 policy constraints handling in the constraints plugin and fixed some issues. The previous code was too strict in some respects (e.g. for inhibitPolicyMapping and inhibitAnyPolicy constraints) but also contained other flaws. In particular the handling of requireExplicitPolicy constraints. The latter now causes end entity certificates to get rejected if no valid policy is found.

Download Complete Changelog