Skip to main content
CVE-2026-25075VulnerabilityPublished Updated

Bundesamt für Sicherheit in der Informationstechnik Debian · strongSwan: Schwachstelle ermöglicht Denial of Service

Affects Bundesamt für Sicherheit in der Informationstechnik DebianSource GCVE Database

0
Compare

Not known to be exploited.

Data as of 30 Oct 2026, 11:52 UTC

Severity
Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS
1.0% chance of exploitation in 30 days – higher than 64% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 23 Mar 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: evidence found.

    Public exploit code: GitHub proofs of concept

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

What to do

AI-suggested

A fix is available and can be applied by updating strongSwan packages to the versions specified in the Ubuntu advisory USN-8117-1. Standard system updates on affected Ubuntu releases will apply the necessary patches. Users should update to strongSwan 6.0.1-6ubuntu4.2 for Ubuntu 25.10, 5.9.13-2ubuntu4.24.04.2 for Ubuntu 24.04 LTS, or 5.9.5-2ubuntu2.5 for Ubuntu 22.04 LTS to remediate this vulnerability.

Description

A vulnerability in strongSwan's eap-ttls plugin allows specially crafted network traffic to cause resource consumption or crash, resulting in denial of service. This issue affects multiple Ubuntu releases and can be mitigated by updating to fixed package versions.

References

Community reviews

Loading reviews…