cyber.hendryadrian.com
Vulnerability & Exploit · hackread.com

CVE-2026-25075 in strongSwan EAP-TTLS Can Crash VPN Services

· Original article ↗

Summary

CVE-2026-25075 is an integer underflow in strongSwan’s EAP-TTLS plugin that researchers say can corrupt memory and crash VPN services. Upgrade to 6.0.5 or later, disable the plugin if unused, or use the non-crashing test tool.

Key points

  • The flaw affects strongSwan versions 4.5.0 through 6.0.4 and is tracked as CVE-2026-25075.
  • A malformed message can trigger an integer underflow in the EAP-TTLS plugin and an attempted allocation of an invalid amount of memory.
  • Researchers describe a two-phase attack: the initial message corrupts the heap, while a later connection can trigger a charon daemon crash.
  • The attack requires a vulnerable version, EAP-TTLS enabled, and IKEv2 connections accepted by the server.
  • strongSwan and Bishop Fox advise upgrading to version 6.0.5 or later; administrators can disable EAP-TTLS if it is not needed.
  • Bishop Fox provides a test tool intended to check exposure without crashing the server.

Article Details

Vulnerability Types
  • Integer underflow
  • Heap corruption
Affected Versions
  • strongSwan 4.5.0 through 6.0.4
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Disable the EAP-TTLS plugin if it is not needed.

MITRE ATT&CK

T1499.004 · Application or System ExploitationA malformed EAP-TTLS message can corrupt the heap, and a subsequent connection can crash the strongSwan charon daemon, disrupting VPN service.

CVE

CVE-2026-25075strongSwan · strongSwanBishop Fox and strongSwan (CVE-2026-25075) advise upgrading vulnerable installations to 6.0.5 or later, disabling EAP-TTLS if unused, and using the provided non-crashing test tool to check for exposure.

Vendors

strongSwanA 15-year-old integer underflow in strongSwan’s EAP-TTLS plugin can trigger massive heap corruption and allow an attacker to knock VPN services offline by forcing impossible memory allocations.

Products

StrongSwanA 15-year-old integer underflow in strongSwan’s EAP-TTLS plugin can trigger massive heap corruption and allow an attacker to knock VPN services offline by forcing impossible memory allocations.