strongSwan 5.0.2 through 6.0.7 allows PKCS#7 certificate enumeration in the openssl plugin that leads to a lack of release of memory after i

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• strongswan strongswan5.0.2 and later · before 6.1.0

Versions reported by the vendor

Affected version ranges reported by the assigning authority (mitre). Independent of NVD's CPE analysis and usually ahead of it.

• strongSwan strongSwan

  • 5.0.2 and later · before 6.1.0affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2023-41913strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the int
  40Plan
• CVE-2023-26463strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes wit
  40Plan
• CVE-2015-3991strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
  40Plan
• CVE-2021-45079In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (
  37Monitor
• CVE-2026-25075strongSwan 4.5.0 < 6.0.5 EAP-TTLS AVP Parsing Integer Underflow
  34Monitor
• CVE-2025-62291In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 th
  32Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.