Description

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-22T22:16:28.153Z",
  "pubdate": "2026-08-22T22:16:28.153Z",
  "executiveSummary": "This vulnerability involves a memory management flaw within strongSwan before version 6.0.7, specifically residing in the identity parsing and cloning routines. The issue manifests when processing EAP-Identities that yield an empty yet non-NULL encoding representation. Due to improper cloning logic, duplicate identity structures are incorrectly handled, leading to a critical double-free condition upon destruction of the duplicate objects.\nThe primary impact of this flaw is memory corruption within the strongSwan daemon, which can lead to a denial of service (DoS) state via application crashes. Depending on the memory allocator implementation, heap corruption could potentially introduce broader stability or security implications. The affected systems are instances running vulnerable versions of strongSwan performing Extensible Authentication Protocol (EAP) authentication.\nAttacker capabilities are focused on triggering instability and service disruption through malformed or specific EAP-Identity inputs. Exploitation typically requires the ability to initiate or participate in an authentication exchange with the vulnerable strongSwan gateway or peer, exposing the network service to unauthenticated or authenticated triggers depending on the specific phase of the IKE/EAP negotiation where the identity is processed.",
  "technicalDetails": "The root cause of the vulnerability lies in the memory management logic responsible for parsing and cloning identity objects within strongSwan before version 6.0.7. Specifically, when the parser encounters or generates a parsed EAP-Identity resulting in an empty encoding that is nonetheless non-NULL, the internal duplication or cloning functions fail to allocate or reference the memory safely.\nDuring the lifecycle of the identity object, duplicates are created to facilitate various internal routing, logging, or state-machine operations. When these duplicated identity structures are subsequently destroyed or cleaned up, the erroneous cloning mechanism results in the same memory address being freed multiple times. This double-free condition corrupts the heap metadata managed by the underlying memory allocator.\nThe vulnerable component is the identity parsing and cloning subsystem handling EAP-Identities. Affected versions include all strongSwan releases prior to 6.0.7. The network exposure is tied to services and endpoints configured to process EAP authentication over IPsec (IKEv2), making the parsing routines reachable during the authentication phase of the protocol exchange.\nThe attack flow proceeds as follows: First, an attacker interacts with the strongSwan service by initiating an IKEv2 negotiation that incorporates EAP authentication. Second, the attacker supplies or induces a specific EAP-Identity payload designed to result in an empty but non-NULL encoding upon parsing. Third, strongSwan parses the identity and invokes the cloning logic to duplicate the structure. Fourth, as the transaction concludes or error handling tears down the objects, the duplicated structures are destroyed, triggering the double-free condition. Finally, the memory corruption crashes the strongSwan process, resulting in a denial of service for all users relying on the gateway."
}