--- title: strongSwan CVE-2026-25075: Integer Underflow in VPN... description: Bishop Fox researchers detail CVE-2026-25075, an integer underflow in strongSwan's EAP-TTLS AVP parser affecting versions 4.5.0 through 6.0.4, spanning over 15... canonical: https://daily.dev/posts/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication-6tkcqb35o twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication | daily.dev og:description: Bishop Fox researchers detail CVE-2026-25075, an integer underflow in strongSwan's EAP-TTLS AVP parser affecting versions 4.5.0 through 6.0.4, spanning over 15... og:url: https://daily.dev/posts/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication-6tkcqb35o og:image: https://api.daily.dev/og/posts/6TkcqB35O.png og:image:alt: strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 10 min read · 0 upvotes · 0 comments ## Summary Bishop Fox researchers detail CVE-2026-25075, an integer underflow in strongSwan's EAP-TTLS AVP parser affecting versions 4.5.0 through 6.0.4, spanning over 15 years of releases. A crafted 4-byte AVP with length=1 triggers a signed integer underflow, causing an attempted 18-exabyte memory allocation that corrupts heap structures, sometimes requiring a two-phase attack to trigger a segmentation fault and crash the IKE daemon. Exploitation requires no authentication and only that EAP-TTLS is enabled. The vendor patched the issue in version 6.0.5 by adding a bounds check before the subtraction. Bishop Fox released a safe, non-disruptive detection script on GitHub and recommends upgrading immediately or disabling EAP-TTLS if unused. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-25075 and which strongSwan versions are affected? CVE-2026-25075 is an integer underflow in the EAP-TTLS AVP parser affecting strongSwan versions 4.5.0 through 6.0.4, spanning over 15 years of releases. Sending an AVP with length=1 causes data_len to underflow to a massive unsigned value, triggering an attempted 18-exabyte memory allocation that can crash the IKE daemon. It requires no authentication and is fixed in version 6.0.5. _Track VPN security advisories like this one on daily.dev to stay ahead of strongSwan patches._ ### How does the strongSwan EAP-TTLS integer underflow crash cause a two-phase attack? On some malloc implementations, sending a malicious AVP with length=1 doesn't crash the daemon immediately; instead it corrupts heap management structures without crashing. A second connection sending another malicious AVP forces malloc to reuse the corrupted heap metadata, returning NULL or an invalid pointer, and the subsequent memcpy write causes a segmentation fault. On systems where malloc immediately returns NULL, a single request crashes the daemon without needing a second phase. _Developers debugging heap corruption bugs can follow VPN vulnerability breakdowns like this via daily.dev._ ### How can I safely test if my strongSwan server is vulnerable to CVE-2026-25075 without crashing it? Send an AVP header with length=1 but no data payload; the integer underflow still occurs but the resulting memcpy call copies zero bytes, which is a safe no-op even against a NULL or corrupted pointer, leaving the server running normally. Vulnerable servers process the malformed AVP and continue the exchange, while patched servers (6.0.5+) reject it due to added validation. A ready-made detection script is published as CVE-2026-25075-check on GitHub. _Security teams verifying VPN exposure can keep up with disclosure tooling like this through daily.dev._ ## Similar posts on daily.dev - [Critical Check Point VPN Zero-Day Exploited in the Wild \(CVE-2026-50751\)](https://daily.dev/posts/critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751--8lk5ari1g) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments - [From a Silent Math Error to Certificate Bypass: Uncovering an Integer Overflow in a TLS Parser](https://daily.dev/posts/from-a-silent-math-error-to-certificate-bypass-uncovering-an-integer-overflow-in-a-tls-parser-dt1x6vmjr) · InfoSec Write-ups · 0 upvotes · 0 comments - [Marking Your Own Homework \(Check Point Remote Access VPN IKEv1 Authentication Bypass CVE-2026-50751\)](https://daily.dev/posts/marking-your-own-homework-check-point-remote-access-vpn-ikev1-authentication-bypass-cve-2026-50751--dcnkf5kqm) · watchTowr Labs · 0 upvotes · 0 comments - [Check Point VPN Authentication Bypass \(CVE-2026-50751\): Client-Controlled IKEv1 Auth Flipped by Ransomware Affiliate](https://daily.dev/posts/check-point-vpn-authentication-bypass-cve-2026-50751-client-controlled-ikev1-auth-flipped-by-rans-ehcuolknf) · Latest Hacking News · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#vulnerability](https://daily.dev/tags/vulnerability), [#vpn](https://daily.dev/tags/vpn) [View this post on daily.dev](https://daily.dev/posts/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication-6tkcqb35o) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication","url":"https://daily.dev/posts/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication-6tkcqb35o","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication-6tkcqb35o"},"datePublished":"2026-08-23T12:21:39.771Z","dateModified":"2026-08-23T12:42:26.415Z","description":"Bishop Fox researchers detail CVE-2026-25075, an integer underflow in strongSwan's EAP-TTLS AVP parser affecting versions 4.5.0 through 6.0.4, spanning over 15...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4ce515347dfcce9b6b43b5bea35b7c80?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4ce515347dfcce9b6b43b5bea35b7c80?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication-6tkcqb35o","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,vulnerability,vpn","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"strongSwan CVE-2026-25075: Integer Underflow in VPN Authentication"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/strongswan-cve-2026-25075-integer-underflow-in-vpn-authentication-6tkcqb35o#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-25075 and which strongSwan versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-25075 is an integer underflow in the EAP-TTLS AVP parser affecting strongSwan versions 4.5.0 through 6.0.4, spanning over 15 years of releases. Sending an AVP with length=1 causes data_len to underflow to a massive unsigned value, triggering an attempted 18-exabyte memory allocation that can crash the IKE daemon. It requires no authentication and is fixed in version 6.0.5. Track VPN security advisories like this one on daily.dev to stay ahead of strongSwan patches."}},{"@type":"Question","name":"How does the strongSwan EAP-TTLS integer underflow crash cause a two-phase attack?","acceptedAnswer":{"@type":"Answer","text":"On some malloc implementations, sending a malicious AVP with length=1 doesn't crash the daemon immediately; instead it corrupts heap management structures without crashing. A second connection sending another malicious AVP forces malloc to reuse the corrupted heap metadata, returning NULL or an invalid pointer, and the subsequent memcpy write causes a segmentation fault. On systems where malloc immediately returns NULL, a single request crashes the daemon without needing a second phase. Developers debugging heap corruption bugs can follow VPN vulnerability breakdowns like this via daily.dev."}},{"@type":"Question","name":"How can I safely test if my strongSwan server is vulnerable to CVE-2026-25075 without crashing it?","acceptedAnswer":{"@type":"Answer","text":"Send an AVP header with length=1 but no data payload; the integer underflow still occurs but the resulting memcpy call copies zero bytes, which is a safe no-op even against a NULL or corrupted pointer, leaving the server running normally. Vulnerable servers process the malformed AVP and continue the exchange, while patched servers (6.0.5+) reject it due to added validation. A ready-made detection script is published as CVE-2026-25075-check on GitHub. Security teams verifying VPN exposure can keep up with disclosure tooling like this through daily.dev."}}]} ```