Debian DSA-6487-1 covers eleven vulnerabilities in strongSwan, the IKE/IPsec implementation. Debian’s tracker lists 6.0.1-6+deb13u7 as fixed for Debian 13 (Trixie). The advisory matters to hosts that actually run strongSwan and use the affected code paths; it does not make an ordinary Linux host vulnerable merely because it runs Debian.
What does DSA-6487-1 cover?
The advisory groups issues across certificate and PKCS#7 processing, EAP authentication plugins, and the libcharon IKE control plane. Reported consequences include crashes, memory exhaustion, incorrect identity binding, and a use-after-free with potentially serious impact. The exact scope is CVE- and plugin-specific, so the headline count should not be treated as a universal severity rating.
The Debian Security Tracker is the authoritative place to confirm the package state and fixed version for the release you use: DSA-6487-1.
Which strongSwan components are implicated?
The advisory is easiest to interpret CVE by CVE. This map preserves the documented component and consequence without treating every plugin as enabled in every deployment.
| CVE | Component/path | Documented consequence |
|---|---|---|
| CVE-2026-78123 | openssl, PKCS#7 containers |
Undefined memory access; crash |
| CVE-2026-78124 | openssl, PKCS#7 certificate enumeration |
Memory leak |
| CVE-2026-78126 | eap-aka, unexpected AKA-Synchronization-Failure |
NULL-pointer dereference; crash |
| CVE-2026-78127 | libcharon, IKE message logging |
Memory exhaustion; denial of service |
| CVE-2026-78129 | libstrongswan, encrypted PKCS#7 decryption |
Unbounded iteration; denial of service |
| CVE-2026-78130 | x509, X.509 attribute-certificate verification |
NULL-pointer dereference; denial of service |
| CVE-2026-78131 | x509, attribute-certificate identity parsing |
Memory exhaustion; denial of service |
| CVE-2026-78132 | x509, ietfAttrSyntax ASN.1 parsing |
Infinite loop; denial of service |
| CVE-2026-78133 | libcharon, IKEv2 rekeying collisions |
Use-after-free; potentially remote code execution by an authenticated peer |
| CVE-2026-78134 | eap-peap and eap-ttls, inner-EAP identity propagation |
Incorrect identity binding; potential authorization bypass |
| CVE-2026-78135 | libcharon, CREATE_CHILD_SA on unestablished IKE SAs |
Usable Child SA before authentication completes |
Sources: Debian’s advisory and the strongSwan 6.1.0 release notes. The table is a scope aid, not a substitute for checking the affected plugin and protocol path.
The upstream disclosure narrows the CVE-2026-78133 RCE possibility to particular IKEv2 multi-key-exchange rekey-collision conditions and an authenticated peer; it is not proof that a particular host is exploitable.
Who is actually in scope?
The short answer is: strongSwan IPsec gateways and clients require review; hosts that do not run strongSwan are outside this package advisory’s direct scope. A server can still be exposed through a strongSwan control plane even when its protected application is otherwise private, because IKE and authentication processing sit at the remote-access boundary.
Do not infer exposure from a CVE score alone. Confirm the installed distribution package, the strongSwan release branch, and whether the affected plugin or protocol function is enabled. Debian’s fixed-package record and upstream’s security notes should be read together because downstream package versions are not always numerically identical to upstream releases.
What the advisory does not establish
DSA-6487-1 establishes that Debian shipped a security update and identifies the vulnerable and fixed package states. It does not, by itself, establish active exploitation, identify every reachable attack path in every configuration, or justify claiming that all eleven CVEs affect all strongSwan users.
That distinction matters for small operators. A narrowly scoped IPsec client, a full site-to-site gateway, and a host using EAP-TTLS do not present the same trust boundary. Use the advisory to identify the relevant decision, then use the cited upstream and CVE records to validate the precise scope.
Sources and freshness
- Debian Security Tracker: DSA-6487-1
- Debian strongSwan source-package tracker
- strongSwan 6.1.0 release notes
- Debian DSA-6487-1 advisory
- strongSwan disclosure for CVE-2026-78133
- strongSwan disclosure for CVE-2026-78134
- strongSwan disclosure for CVE-2026-78135
For broader design context, see the secure remote access Linux server guide and the WireGuard Linux server comparison. This article intentionally does not provide upgrade commands or an operational remediation procedure; those would require Track B evidence for a named environment.