Infinite Loop Vulnerability in strongSwan VPN Software
CVE-2026-78129

5.9MEDIUM

Key Information:

Vendor

Strongswan

Status
Strongswan
Vendor
CVE Published:
11 September 2026

What is CVE-2026-78129?

The strongSwan VPN software versions 4.6.2 through 6.0.7 are impacted by a vulnerability that leads to an infinite loop during PKCS#5 decryption processes. This can result in a denial of service condition, affecting the availability and performance of the VPN service. Users of these versions are urged to upgrade to the latest version to mitigate potential risks associated with this flaw, ensuring the integrity of their network communications.

Affected Version(s)

strongSwan 4.6.2 < 6.1.0

References

https://github.com/strongswan/strongswan/releases/tag/6.1.0
https://www.strongswan.org/blog/2026/09/07/strongswan-vul...

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.