Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
strongswan may crash or leak memory processing certificates
published 1 month ago
Summary
The strongswan VPN software on SUSE systems can run out of memory or stop working when it handles certain encrypted files and certificate data. This could cause service interruptions or slow performance. Apply the latest strongswan update from SUSE as soon as possible to fix these issues.
What to do
- Update suse strongswan to version 5.1.3-26.43.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Server 12 SP5-LTSS | suse | strongswan |
< 5.1.3-26.43.2 Fix: upgrade to 5.1.3-26.43.2
|
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | suse | strongswan |
< 5.1.3-26.43.2 Fix: upgrade to 5.1.3-26.43.2
|
Original advisory text
Security update for strongswan
This update for strongswan fixes the following issues:
- CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).
- CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).
- CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).
- CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).
- CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).
- CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).
- CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).
- CVE-2026-78123: Undefined Memory Access When Handling PKCS#7 Containers (bsc#1276533).
- CVE-2026-78124: Memory Leak When Processing Certificates in PKCS#7 Containers (bsc#1276534).
- CVE-2026-78126: NULL-Pointer Dereference When Handling AKA-Synchronization-Failure (bsc#1276536).
- CVE-2026-78127: Memory Leak During Message Stringification (bsc#1276539).
- CVE-2026-78129: Unbounded Iteration When Decrypting PKCS#7 Containers (bsc#1276540).
- CVE-2026-78130: NULL-Pointer Dereference in Attribute Certificate Validation (bsc#1276541).
- CVE-2026-78131: Memory Leaks When Parsing Attribute Certificates (bsc#1276543).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20264147-1/ Vendor Advisory
- https://bugzilla.suse.com/1276533 Third Party Advisory
- https://bugzilla.suse.com/1276534 Third Party Advisory
- https://bugzilla.suse.com/1276536 Third Party Advisory
- https://bugzilla.suse.com/1276539 Third Party Advisory
- https://bugzilla.suse.com/1276540 Third Party Advisory
- https://bugzilla.suse.com/1276541 Third Party Advisory
- https://bugzilla.suse.com/1276543 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-78123 URL
- https://www.suse.com/security/cve/CVE-2026-78124 URL
- https://www.suse.com/security/cve/CVE-2026-78126 URL
- https://www.suse.com/security/cve/CVE-2026-78127 URL
- https://www.suse.com/security/cve/CVE-2026-78129 URL
- https://www.suse.com/security/cve/CVE-2026-78130 URL
- https://www.suse.com/security/cve/CVE-2026-78131 URL
Timeline
Published14 Sep 2026
Updated15 Sep 2026
First seen15 Sep 2026
Sources
SUSE-SU-2026:4147-1 · OSV
Track software like this
Free during beta