Practical Linux guidance for safer servers and self-hosted systems.Linux • Security • Self-hosting • Practical tools
Secure Remote Access

Debian DSA-6487-1 strongSwan Security Update: What IPsec Operators Need to Know

Debian DSA-6487-1 covers eleven vulnerabilities in strongSwan, the IKE/IPsec implementation. Debian’s tracker lists 6.0.1-6+deb13u7 as fixed for Debian 13 (Trixie). The advisory matters to hosts that actually run strongSwan and use the affected code paths; it does not make an ordinary Linux host vulnerable merely because it runs Debian.

What does DSA-6487-1 cover?

The advisory groups issues across certificate and PKCS#7 processing, EAP authentication plugins, and the libcharon IKE control plane. Reported consequences include crashes, memory exhaustion, incorrect identity binding, and a use-after-free with potentially serious impact. The exact scope is CVE- and plugin-specific, so the headline count should not be treated as a universal severity rating.

The Debian Security Tracker is the authoritative place to confirm the package state and fixed version for the release you use: DSA-6487-1.

Which strongSwan components are implicated?

The advisory is easiest to interpret CVE by CVE. This map preserves the documented component and consequence without treating every plugin as enabled in every deployment.

CVE Component/path Documented consequence
CVE-2026-78123 openssl, PKCS#7 containers Undefined memory access; crash
CVE-2026-78124 openssl, PKCS#7 certificate enumeration Memory leak
CVE-2026-78126 eap-aka, unexpected AKA-Synchronization-Failure NULL-pointer dereference; crash
CVE-2026-78127 libcharon, IKE message logging Memory exhaustion; denial of service
CVE-2026-78129 libstrongswan, encrypted PKCS#7 decryption Unbounded iteration; denial of service
CVE-2026-78130 x509, X.509 attribute-certificate verification NULL-pointer dereference; denial of service
CVE-2026-78131 x509, attribute-certificate identity parsing Memory exhaustion; denial of service
CVE-2026-78132 x509, ietfAttrSyntax ASN.1 parsing Infinite loop; denial of service
CVE-2026-78133 libcharon, IKEv2 rekeying collisions Use-after-free; potentially remote code execution by an authenticated peer
CVE-2026-78134 eap-peap and eap-ttls, inner-EAP identity propagation Incorrect identity binding; potential authorization bypass
CVE-2026-78135 libcharon, CREATE_CHILD_SA on unestablished IKE SAs Usable Child SA before authentication completes

Sources: Debian’s advisory and the strongSwan 6.1.0 release notes. The table is a scope aid, not a substitute for checking the affected plugin and protocol path.

The upstream disclosure narrows the CVE-2026-78133 RCE possibility to particular IKEv2 multi-key-exchange rekey-collision conditions and an authenticated peer; it is not proof that a particular host is exploitable.

Who is actually in scope?

The short answer is: strongSwan IPsec gateways and clients require review; hosts that do not run strongSwan are outside this package advisory’s direct scope. A server can still be exposed through a strongSwan control plane even when its protected application is otherwise private, because IKE and authentication processing sit at the remote-access boundary.

Do not infer exposure from a CVE score alone. Confirm the installed distribution package, the strongSwan release branch, and whether the affected plugin or protocol function is enabled. Debian’s fixed-package record and upstream’s security notes should be read together because downstream package versions are not always numerically identical to upstream releases.

What the advisory does not establish

DSA-6487-1 establishes that Debian shipped a security update and identifies the vulnerable and fixed package states. It does not, by itself, establish active exploitation, identify every reachable attack path in every configuration, or justify claiming that all eleven CVEs affect all strongSwan users.

That distinction matters for small operators. A narrowly scoped IPsec client, a full site-to-site gateway, and a host using EAP-TTLS do not present the same trust boundary. Use the advisory to identify the relevant decision, then use the cited upstream and CVE records to validate the precise scope.

Sources and freshness

For broader design context, see the secure remote access Linux server guide and the WireGuard Linux server comparison. This article intentionally does not provide upgrade commands or an operational remediation procedure; those would require Track B evidence for a named environment.