Bundesamt für Sicherheit in der Informationstechnik Debian · strongSwan: Schwachstelle ermöglicht Denial of Service
Affects Bundesamt für Sicherheit in der Informationstechnik DebianSource GCVE Database
Not known to be exploited.
Data as of 30 Oct 2026, 11:52 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 1.0% chance of exploitation in 30 days – higher than 64% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
AI-suggested
A fix is available and can be applied by updating strongSwan packages to the versions specified in the Ubuntu advisory USN-8117-1. Standard system updates on affected Ubuntu releases will apply the necessary patches. Users should update to strongSwan 6.0.1-6ubuntu4.2 for Ubuntu 25.10, 5.9.13-2ubuntu4.24.04.2 for Ubuntu 24.04 LTS, or 5.9.5-2ubuntu2.5 for Ubuntu 22.04 LTS to remediate this vulnerability.
Description
A vulnerability in strongSwan's eap-ttls plugin allows specially crafted network traffic to cause resource consumption or crash, resulting in denial of service. This issue affects multiple Ubuntu releases and can be mitigated by updating to fixed package versions.
References
- wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0825.json (opens in a new tab)
- wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0825 (opens in a new tab)
- strongswan.org/blog/2026/03/23/strongswan-6.0.5-released.html (opens in a new tab)
- lists.suse.com/pipermail/sle-security-updates/2026-March/024819.html (opens in a new tab)
- lists.suse.com/pipermail/sle-security-updates/2026-March/024816.html (opens in a new tab)
- lists.suse.com/pipermail/sle-security-updates/2026-March/024818.html (opens in a new tab)
- lists.suse.com/pipermail/sle-security-updates/2026-March/024817.html (opens in a new tab)
- ubuntu.com/security/notices/USN-8117-1 (opens in a new tab)
- lists.debian.org/debian-lts-announce/2026/03/msg00016.html (opens in a new tab)
- lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BPTMJSZMW4PWZWFN2UOYO2A5QDM5UXSP/ (opens in a new tab)
- lists.suse.com/pipermail/sle-security-updates/2026-April/025329.html (opens in a new tab)
- lists.suse.com/pipermail/sle-security-updates/2026-April/025497.html (opens in a new tab)
- lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2DW5IMNZ3SL7RFDFTK5NRFU53MWRCC4X/ (opens in a new tab)
- bodhi.fedoraproject.org/updates/FEDORA-2026-cc6fcd3a58 (opens in a new tab)
- bodhi.fedoraproject.org/updates/FEDORA-2026-43e98c9972 (opens in a new tab)
- bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9b6d13e4b9 (opens in a new tab)
- bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-ea9af18b11 (opens in a new tab)
- bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-2d8dd834d8 (opens in a new tab)
- bodhi.fedoraproject.org/updates/FEDORA-2026-67a9805962 (opens in a new tab)