strongSwan EAP-Identity Double-Free in IKE Authentication
strongSwan before 6.0.7 mishandles cloning of EAP-Identities with empty but non-NULL encodings, triggering a double-free during IKE authentication. Can crash the IKE daemon; potential heap corruption depending on allocator.
- Vendor
- strongSwan Project
- Product
- strongSwan (all versions before 6.0.7)
- CVSS
- 7.5
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
strongSwan’s identity parsing code does not correctly clone EAP-Identities that produce an empty but non-NULL byte encoding. When the duplicated identity objects are destroyed during IKE authentication teardown, the same underlying memory buffer is freed twice.
The double-free occurs in the authentication path and can crash the IKE daemon (charon). On allocators that do not trap double-frees, heap corruption is possible, raising the risk beyond denial-of-service.
Affected versions: All strongSwan releases before 6.0.7.
Fix: strongSwan 6.0.7, released August 22, 2026. Upgrade immediately. If a vendor-packaged version is in use, check your distribution’s security tracker for a backported patch.
No public exploit code has been published and CISA has not added this to the KEV catalog as of publication.