DEBIAN-CVE-2026-25075

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-25075
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-25075.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-25075
Upstream
  • CVE-2026-25075
Downstream
Published
2026-03-23T19:16:39.313Z
Modified
2026-03-28T08:00:11.285473Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allows unauthenticated remote attackers to cause a denial of service by sending crafted AVP data with invalid length fields during IKEv2 authentication. Attackers can exploit the failure to validate AVP length fields before subtraction to trigger excessive memory allocation or NULL pointer dereference, crashing the charon IKE daemon.

References

Affected packages

Debian:11 / strongswan

Package

Name
strongswan
Purl
pkg:deb/debian/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.9.1-1+deb11u6

Affected versions

5.*
5.9.1-1
5.9.1-1+deb11u1
5.9.1-1+deb11u2
5.9.1-1+deb11u3
5.9.1-1+deb11u4
5.9.1-1+deb11u5

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-25075.json"

Debian:12 / strongswan

Package

Name
strongswan
Purl
pkg:deb/debian/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.9.8-5+deb12u3

Affected versions

5.*
5.9.8-5
5.9.8-5+deb12u1
5.9.8-5+deb12u2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-25075.json"

Debian:13 / strongswan

Package

Name
strongswan
Purl
pkg:deb/debian/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.1-6+deb13u4

Affected versions

6.*
6.0.1-6
6.0.1-6+deb13u1
6.0.1-6+deb13u2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-25075.json"

Debian:14 / strongswan

Package

Name
strongswan
Purl
pkg:deb/debian/strongswan?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.5-1

Affected versions

6.*
6.0.1-6
6.0.2-1
6.0.3-1
6.0.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-25075.json"