This update for strongSwan fixes seven distinct vulnerabilities (CVE-2026-35328 through CVE-2026-35334) and one additional CVE (CVE-2026-47895). The issues include an infinite loop triggered by supported versions TLS extension, null pointer dereferences in PKCS#7 padding processing and ECDH public value handling, integer underflows in EAP-SIM/AKA and RADIUS attribute processing, acceptance of certificates violating name constraints, a possible null pointer dereference during RSA decryption, and a double-free vulnerability when destroying certain cloned identities. These vulnerabilities affect strongSwan version 5.9.11-150500.5.23.2 on the aarch64 platform as distributed by SUSE. No CVSS scores are provided. The vulnerabilities collectively pose a high severity risk.

The vulnerabilities can cause denial of service conditions such as infinite loops and crashes due to null pointer dereferences and double-free errors. Acceptance of certificates violating name constraints may weaken authentication guarantees. Integer underflows in protocol attribute handling could lead to unexpected behavior or memory corruption. These issues collectively undermine the reliability and security of strongSwan VPN deployments on affected versions.

A security update is available from the SUSE Product Security Team that addresses these vulnerabilities in strongSwan version 5.9.11-150500.5.23.2 for aarch64. Users should apply the official SUSE patch or update to the fixed version as provided by SUSE. Patch status is confirmed by the vendor advisory. No cloud service remediation applies as this is not a cloud service. There are no known exploits in the wild at this time.