AISLE Research reported a bug in the x509 plugin related to the verification of X.509 attribute certificates that can lead to a denial of service.
NULL-Pointer Dereference in Attribute Certificate Validation
The x509 plugin doesn't check if the issuerName field is set in an attribute certificate before dereferencing it during verification, which can cause a crash. Affected are all strongSwan versions since 4.2.0.
CVE-2026-78130 has been assigned for this vulnerability.
Missing NULL-Check in Attribute Certificate Validation
The x509 plugin supports parsing attribute certificates that can be used for authorization (see e.g. RFC 5755). When parsing such a certificate, the issuerName field is optional per ASN.1 definition. Similarly is the AuthorityKeyIdentifier extension optional.
When an attribute certificate certificate is validated by the acert plugin, it calls the certificate's issued_by() method. This method contains two checks to quickly decide if the certificate is not issued by a given issuer. The first uses the AuthorityKeyIdentifier if one was found in the certificate. However, if that's not the case, it falls back to comparing the issuerName with the issuer certificate's subject. To do so it unconditionally calls this->issuerName->equals(). So if no issuerName was parsed, this causes a NULL-pointer dereference.
The same pattern is also found in the has_issuer() method, where this->issuerName->matches() is called unconditionally. This method is mostly used for CRLs. And while the legacy ipsec/stroke listcerts command uses the method to group together certificates by the same issuer, the validation would cause a crash before such a certificate ends up in the certificate cache.
Remote code execution is not possible due to this issue.
As mentioned in the introduction, credit to AISLE Research for finding this vulnerability and reporting it responsibly.
Mitigation
Installations that don't load the acert and x509 plugins are not vulnerable. Note that the latter is built and loaded by default. However, without the acert plugin, any parsed attribute certificate will just get ignored and not validated.
The just released strongSwan 6.1.0 fixes this vulnerability. For older releases, we provide a patch that fix the vulnerability and should apply with appropriate hunk offsets. Please be aware that we don't provide any patches for releases older than 5.1.3.