strongSwan versions 4.1.10 through 6.0.7 contain a vulnerability in the eap-aka plugin where improper handling of AKA-Synchronization-Failure messages can cause a NULL pointer dereference. This results in a denial of service by crashing the strongSwan service. The vulnerability is tracked as CVE-2026-78126 with a medium severity rating and a CVSS score of 5.9. Official patches are available for supported Ubuntu releases.