strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate AVP length fields before subtraction to trigger excessive memory allocation or NULL pointer dereference, crashing the charon IKE daemon.

An update of the strongswan package has been released.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4512 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4512-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     March 27, 2026                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : strongswan     Version        : 5.9.1-1+deb11u6     CVE ID         : CVE-2026-25075


    Kazuma Matsumoto discovered an integer overflow bug in the EAP-TTLS plugin     of strongSwan, an IKE/IPsec suite.


    The EAP-TTLS plugin doesn't check the length field in the header of     attribute-value pairs (AVPs) tunneled in EAP-TTLS, which can cause an     integer underflow that may lead to a crash. An unauthenticated attacker     could exploit this for a DoS attack by sending a crafted message.



    For Debian 11 bullseye, this problem has been fixed in version     5.9.1-1+deb11u6.

    We recommend that you upgrade your strongswan packages.

    For the detailed security status of strongswan please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/strongswan

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by a vulnerability as referenced in the USN-8117-1 advisory.

    Kazuma Matsumoto discovered that strongSwan incorrectly handled EAP-TTLS AVPs when using the eap-ttls     plugin. An attacker could possibly use this issue to cause strongSwan to consume resources and crash,     resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0981-1 advisory.

    - CVE-2026-25075: Fixed integer underflow when handling EAP-TTLS AVP (bsc#1259472).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0979-1 advisory.

    - CVE-2026-25075: Fixed integer underflow when handling EAP-TTLS AVP (bsc#1259472).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0978-1 advisory.

    - CVE-2026-25075: Fixed integer underflow when handling EAP-TTLS AVP (bsc#1259472).

    Other bug fixes:

    -Fix rpm scripts to not break swanctl.conf use (bsc#1256442):
       * Guard rpm migration scripts migrating strongswan.service          using ipsec.conf on less than 5.8 to strongswan-starter.service          by checking the ipsec.service alias provider.
       * Call systemd macros for both, strongswan-starter and the strongswan service.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0980-1 advisory.

    - CVE-2026-25075: Fixed integer underflow when handling EAP-TTLS AVP (bsc#1259472).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP     parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP     data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate     AVP length fields before subtraction to trigger excessive memory allocation or NULL pointer dereference,     crashing the charon IKE daemon. (CVE-2026-25075)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6176 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6176-1                   security@debian.org     https://www.debian.org/security/                        Yves-Alexis Perez     March 23, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : strongswan     CVE ID         : CVE-2026-25075

    Kazuma Matsumoto discovered an integer overflow bug in the EAP-TTLS plugin of     strongSwan, an IKE/IPsec suite.

    The EAP-TTLS plugin doesn't check the length field in the header of     attribute-value pairs (AVPs) tunneled in EAP-TTLS, which can cause an integer     underflow that may lead to a crash. An unauthenticated attacker could exploit     this for a DoS attack by sending a crafted message.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 5.9.8-5+deb12u3.

    For the stable distribution (trixie), this problem has been fixed in     version 6.0.1-6+deb13u4.

    We recommend that you upgrade your strongswan packages.

    For the detailed security status of strongswan please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/strongswan

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
305124	Photon OS 5.0: Strongswan PHSA-2026-5.0-0802	Nessus	PhotonOS Local Security Checks	high
304020	Debian dla-4512 : charon-cmd - security update	Nessus	Debian Local Security Checks	high
303756	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : strongSwan vulnerability (USN-8117-1)	Nessus	Ubuntu Local Security Checks	high
303579	SUSE SLES15 Security Update : strongswan (SUSE-SU-2026:0981-1)	Nessus	SuSE Local Security Checks	high
303576	SUSE SLES15 / openSUSE 15 Security Update : strongswan (SUSE-SU-2026:0979-1)	Nessus	SuSE Local Security Checks	high
303572	SUSE SLES15 Security Update : strongswan (SUSE-SU-2026:0978-1)	Nessus	SuSE Local Security Checks	high
303571	SUSE SLED15 / SLES15 Security Update : strongswan (SUSE-SU-2026:0980-1)	Nessus	SuSE Local Security Checks	high
303377	Linux Distros Unpatched Vulnerability : CVE-2026-25075	Nessus	Misc.	high
303374	Debian dsa-6176 : charon-cmd - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2026-25075

high

Tenable Plugins

high

high

high

high

high

high

high

high

high