CVE-2026-25075
Description
A flaw was found in strongSwan. An unauthenticated remote attacker can exploit an integer underflow vulnerability in the EAP-TTLS AVP (Attribute-Value Pair) parser. By sending specially crafted AVP data with invalid length fields during IKEv2 (Internet Key Exchange version 2) authentication, the attacker can trigger excessive memory allocation or a NULL pointer dereference. This ultimately leads to a Denial of Service (DoS) by crashing the charon IKE daemon.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this issue, consider disabling EAP-TTLS authentication if it is not required for your strongSwan deployment. This can be achieved by removing or commenting out EAP-TTLS related configurations in `ipsec.conf` or `strongswan.conf`. Alternatively, restrict network access to the strongSwan service by configuring firewall rules to only allow connections from trusted hosts. After modifying strongSwan configuration, a restart of the strongSwan service may be required for changes to take effect, which could temporarily interrupt VPN services.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Instability
This weakness will generally lead to undefined behavior and therefore crashes. In the case of overflows involving loop index variables, the likelihood of infinite loops is also high.
Integrity
Technical Impact: Modify Memory
If the value in question is important to data (as opposed to flow), simple data corruption has occurred. Also, if the wrap around results in other conditions such as buffer overflows, further memory corruption may occur.
Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism
This weakness can sometimes trigger buffer overflows which can be used to execute arbitrary code. This is usually outside the scope of a program's implicit security policy.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
