Skip to content

strongSwan

v6.0.7 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo VPN & Tunnels
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

ikev2 ipsec strongswan vpn vpn-client vpn-server

Affected surfaces

rce_ssrf breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 1mo

ReleasePort Layer 1 6.0.7 fixes a double‑free vulnerability (CVE‑2026‑47895) in libstrongswan that could enable remote code execution and addresses several security issues across plugins.

Why it matters: CVE‑2026‑47895 has severity 95; patch immediately to prevent potential remote code execution. Other fixes close out‑of‑bounds reads (severity 80) and command injection risks, directly protecting deployment integrity.

Summary

AI summary

Broad release touches Plugin and Configuration Changes, Enhancements and Optimizations, For Developers, and Vulnerabilities.

Changes in this release

Security Critical

Fixes CVE-2026-47895 double-free vulnerability in libstrongswan, preventing potential remote code execution.

Fixes CVE-2026-47895 double-free vulnerability in libstrongswan, preventing potential remote code execution.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Security High

Fixes potential command injection when generating SWID tags in non‑recommended configurations.

Fixes potential command injection when generating SWID tags in non‑recommended configurations.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Security High

Fixes potential out‑of‑bounds read in the `dhcp` plugin when processing DHCP messages.

Fixes potential out‑of‑bounds read in the `dhcp` plugin when processing DHCP messages.

Source: granite4.1:30b@2026-06-08-audit

Confidence: high

 —
Security High

Fixes potential client‑side out‑of‑bounds read in the `eap-aka` plugin if AT_RAND is too short.

Fixes potential client‑side out‑of‑bounds read in the `eap-aka` plugin if AT_RAND is too short.

Source: granite4.1:30b@2026-06-08-audit

Confidence: high

 —
Feature Medium

Enforces validity (notBefore/notAfter) of last certificate in incomplete trust chain for pre‑trusted certificates.

Enforces validity (notBefore/notAfter) of last certificate in incomplete trust chain for pre‑trusted certificates.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Feature Medium

Enforces validity of pre‑trusted, self‑signed certificates.

Enforces validity of pre‑trusted, self‑signed certificates.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Feature Medium

Enables mixed‑family IPComp configurations with Linux kernel 6.3 and newer.

Enables mixed‑family IPComp configurations with Linux kernel 6.3 and newer.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Feature Medium

VICI `list-conn` event now includes IKE and IPsec proposals in numbered sections.

VICI `list-conn` event now includes IKE and IPsec proposals in numbered sections.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Feature Medium

`swanctl --list-conns` gains `--ike` option to filter connections by name.

`swanctl --list-conns` gains `--ike` option to filter connections by name.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Feature Medium

`charon-cmd` no longer defaults to IPv4 and adds `--host-local` option for local endpoint configuration.

`charon-cmd` no longer defaults to IPv4 and adds `--host-local` option for local endpoint configuration.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Bugfix Medium

Fixes key derivation failure when an IKE SA is reset after IKE_INTERMEDIATE retransmits.

Fixes key derivation failure when an IKE SA is reset after IKE_INTERMEDIATE retransmits.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Bugfix Medium

Fixes error handling when IKE_INTERMEDIATE request lacks a KE payload.

Fixes error handling when IKE_INTERMEDIATE request lacks a KE payload.

Source: llm_adapter@2026-06-08

Confidence: high

 —
Bugfix Medium

Fixes compatibility of the `openssl` plugin with OpenSSL 4.

Fixes compatibility of the `openssl` plugin with OpenSSL 4.

Source: granite4.1:30b@2026-06-08-audit

Confidence: high

 —
Bugfix Medium

Fixes potential NULL‑pointer dereference in the `pkcs7` plugin after verifying signed attributes.

Fixes potential NULL‑pointer dereference in the `pkcs7` plugin after verifying signed attributes.

Source: granite4.1:30b@2026-06-08-audit

Confidence: high

 —
Bugfix Low

Fixes setting IPv6 addresses on TUN devices on Linux.

Fixes setting IPv6 addresses on TUN devices on Linux.

Source: granite4.1:30b@2026-06-08-audit

Confidence: high

 —
Full changelog

Vulnerabilities

  • CVE-2026-47895 - Fixed a vulnerability in libstrongswan related to the cloning of certain identities that can result in an double-free and potentially remote code execution. Affects 4.3.3 and newer.

Enhancements and Optimizations

  • The validity (notBefore/notAfter) of the last certificate in the incomplete trust chain of a pre-trusted certificate is now enforced. Previously, the validity was only checked if an issuer certificate was found. This particularly affects non-self-signed certificates that are configured explicitly (e.g. in remote.certs in swanctl.conf) but whose CA certificate is not loaded (0d17838b9911458d45826827607b78d999b39dee).
  • Similarly to the above change, the validity of pre-trusted, self-signed certificates is now also enforced (f0a489f7e2054dbfc39ec4aa434a3d5c5fb05069).
  • Enable mixed-family IPComp configs with Linux kernel 6.3 and newer (a904f9125da3642470cb71f07105c35f3796b167).

Plugin and Configuration Changes

  • VICI's list-conn event now includes the IKE and IPsec proposals. A numbered (zero-based) section for each proposal contains lists of algorithm identifiers for each transform type that's found in the proposal. As proposals can be quite extensive, the swanctl --list-conns command currently doesn't print them to keep the output compact, but --raw may be used to see them (#3067, 5b56e56e726b7765537fd05f6c7c30e87c2df181).
  • The swanctl --list-conns command now accepts an --ike option to filter connections by name (5185b6f6e8d09428da4a289495d7ad413d9edf1a).
  • charon-cmd does not default to IPv4 anymore (64e01e281207241986a83889973cfe6bf7495435) and allows configuring the local endpoint via --host-local option (74fd2593a71420abf33930eb2b0b78c14e181c7e).
  • Properly enable (or rather disable) the --with-plugins-packaged-separately option that was added with 6.0.5 (172c2a39d295a60f743a09577186caf88dd912c1).

Fixes

  • Fixed the key derivation if an IKE SA is reset after IKE_INTERMEDIATE retransmits (dc8b479eb890c52acc8034f03855d3539c9ec64b). This previously caused the encryption to fail during the next attempt.
  • Fixed error handling if an IKE_INTERMEDIATE request doesn't contain a KE payload (ac703e48c3e9b41cdbbd221c34469c7c086ae84b).
  • Fixed compatibility of the openssl plugin with OpenSSL 4 (528e5f07c3cdf830f575801298b14f633088932b, 374b17fe886ad1d031f429a1063e0a58847b31f3, 8ff3238027f5774c74c8646e4226e38e8c2c6657).
  • Fixed a potential OOB read on the stack in the dhcp plugin when reading DHCP messages (8f223455424e68a7b21adfa20f5324968c89ee25).
  • Fixed a potential client-side OOB read in the eap-aka plugin if AT_RAND is too short (4df53109a5f18c56743dcf18f8bd5336352c8775).
  • Fixed a potential NULL-pointer dereference in the pkcs7 plugin after verifying signed attributes (531de4d8583c0279a16c00c5b11c87ab295fda7a).
  • Fixed a potential command injection when generating SWID tags in non-recommended configs (9ac3db8e63a59bdd6e4055f2f0498760985b5f42).
  • Fixed setting IPv6 addresses on TUN devices on Linux, although this is currently not used (ea569867d24376eb4059fcf1df93269cc37d6ff3).

For Developers

  • The ike_cfg_t::get_proposals and child_cfg_t::get_proposals methods received a log argument to suppress the level 2 configured proposals: ... log messages they otherwise produce.
  • The OID identifiers for the NIST SECP elliptic curves were renamed by replacing the confusing SECT prefix (bff405c349f90d600586bcb119072ee79d0c6580).
  • Improved cache handling for GitHub CI runs to reduce storage and avoid evicting caches of the base branch when working on multiple feature branches.

Refer to the 6.0.7 milestone for a list of all closed issues and pull requests.

Security Fixes

  • CVE-2026-47895 — Fixed a double‑free vulnerability in libstrongswan when cloning certain identities that could lead to remote code execution (affects versions 4.3.3+)
  • cve-2026-47895
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track strongSwan

Get notified when new releases ship.

Sign up free

About strongSwan

strongSwan - IPsec-based VPN

All releases →

Related context

Related CVEs

Beta — feedback welcome: [email protected]