strongSwan 6.0.7 Patches Double-Free in IKE Auth

The strongSwan Project shipped version 6.0.7 on August 22 to fix CVE-2026-47895, a high-severity double-free in the IKE daemon’s identity-parsing code. CVSS score is 7.5.

What’s broken

strongSwan’s EAP-Identity parsing produces, in certain edge cases, an identity object with an empty but non-NULL byte encoding. When the IKE daemon clones that object — as it does during authentication — and later frees both the original and the clone, it frees the same underlying buffer twice.

The double-free happens in the charon daemon during IKE authentication. The immediate, guaranteed consequence is a daemon crash. On allocators that don’t hard-abort on double-frees, heap corruption is possible, which could push the risk higher than the CVSS score suggests. CISA has not added this to the KEV catalog and no exploit code has been published as of this writing.

Who’s affected

Every strongSwan release before 6.0.7. That covers a wide range of deployments: enterprise IPsec gateways, Linux distribution packages (Debian, Ubuntu, Alpine, openSUSE), and embedded networking gear that ships strongSwan as its IKE daemon.

The attack surface is the IKE authentication exchange — reachable over UDP 500/4500 by any peer attempting a VPN connection. An unauthenticated peer can send the malformed EAP-Identity; no prior trust relationship is required to trigger the crash.

What to do

Upgrade to strongSwan 6.0.7. The upstream release is available at the strongSwan releases page.

If you’re running a distribution-packaged version, check your vendor’s security tracker:

• Debian / Ubuntu — watch the Debian Security Tracker and Ubuntu CVE reports for strongswan
• Alpine — check the Alpine security advisories for the 3.x series
• openSUSE / SLES — SUSE Security Advisories

For environments where an immediate upgrade isn’t possible, restrict IKE daemon access to known peer addresses at the firewall level. This narrows the exposure but does not eliminate it if a trusted peer sends a malformed identity.

Priority call: High. Daemon crashes in IKE infrastructure take down VPN connectivity for every peer relying on that endpoint. If strongSwan is in your stack, patch this before the week is out.

Sourcing

• strongSwan 6.0.7 release notes — fix description and changelog
• NVD entry for CVE-2026-47895

Related coverage: WeeChat Relay Flaw Exposes Auth to Timing Attack · SiYuan v3.7.4 Patches 11 CVEs, Critical RCE Confirmed