Claude / Ada Logics reported a bug in the x509 plugin related to the parsing of the ietfAttrSyntax ASN.1 type in X.509 attribute certificates that can lead to a denial of service.
Infinite Loop When Parsing Attribute Certificates
The x509 plugin doesn't properly parse attributes that use the ietfAttrSyntax type in attribute certificates (group attribute), which can lead to an infinite loop. Affected are all strongSwan versions since 5.1.3.
CVE-2026-78132 has been assigned for this vulnerability.
Missing CHOICE Flags in ietfAttrSyntax Parsing Rules
The x509 plugin supports parsing attribute certificates that can be used for authorization (see e.g. RFC 5755). One of the key elements that can be conveyed with such certificates is group membership. For that purpose the group attribute is used, which uses the ietfAttrSyntax type that's defined as follows:
IetfAttrSyntax ::= SEQUENCE {
policyAuthority [0] GeneralNames OPTIONAL,
values SEQUENCE OF CHOICE {
octets OCTET STRING,
oid OBJECT IDENTIFIER,
string UTF8String
}
}As can be seen, the values are encoded as a SEQUENCE OF CHOICE with three possible alternatives.
In order to parse such structures, the plugin defines an array of rules for strongSwan's ASN.1 parser. For each of the three options the flags are defined as ASN1_OPT|ASN1_BODY. The definition for the whole SEQUENCE OF looks like this:
{ 1, "values", ASN1_SEQUENCE, ASN1_LOOP },
{ 2, "octets", ASN1_OCTET_STRING, ASN1_OPT|ASN1_BODY },
{ 2, "end choice", ASN1_EOC, ASN1_END },
{ 2, "oid", ASN1_OID, ASN1_OPT|ASN1_BODY },
{ 2, "end choice", ASN1_EOC, ASN1_END },
{ 2, "string", ASN1_UTF8STRING, ASN1_OPT|ASN1_BODY },
{ 2, "end choice", ASN1_EOC, ASN1_END },
{ 1, "end loop", ASN1_EOC, ASN1_END },When none of the three alternatives match the parsed data (e.g. because the attribute value uses an unexpected or malformed type), the ASN1_OPT handler skips each alternative without consuming any data. Once the "end loop" marker is reached, the parser jumps back to the start of the ASN1_LOOP and the whole thing repeats indefinitely.
If this sounds familiar, that's because it's the exact same issue that was fixed with CVE-2017-9023 for other CHOICE fields in the x509 plugin. Unfortunately, this part of the plugin was overlooked.
Remote code execution is not possible due to this issue.
As mentioned in the introduction, credit to Claude / Ada Logics for finding this vulnerability and reporting it responsibly.
Mitigation
Installations that don't load the x509 plugin are not vulnerable. Note that it's built and loaded by default.
If the plugin is loaded, attribute certificates are parsed and verified whenever one is received as CERT payload in IKEv2 (encoding type 10). So this issue affects all such installations.
The just released strongSwan 6.1.0 fixes this vulnerability. For older releases, we provide a patch that fixes the vulnerability and should apply with appropriate hunk offsets. Please note that the fix for CVE-2017-9023 is necessary for versions older than 5.5.3.