Two VPN packages had significant Debian security updates in 2026. For OpenVPN, DSA-6376-1 (3 July, Debian 13 trixie) and DLA-4666-1 (4 July, Debian 12 bookworm) fixed six issues that Debian says could result in denial of service. For strongSwan, DSA-6487-1 (7 September, trixie) fixed eleven, including a use-after-free that the strongSwan project says could potentially allow remote code execution.
Bookworm has not received the September strongSwan fixes, and one newer OpenVPN issue is still open on both releases. Details below.
At a glance
| Package | Trixie | Bookworm |
|---|---|---|
strongswan | 6.0.1-6+deb13u7 (DSA-6487-1) | 5.9.8-5+deb12u5 is the latest (DSA-6330-1, June); listed vulnerable to ten of the eleven September CVEs |
openvpn | 2.6.14-1+deb13u3 (DSA-6376-1) | 2.6.14-0+deb12u2 (DLA-4666-1) |
Severity: High (CNA CVSS up to 7.5 for strongSwan and 7.1 for OpenVPN). None of the CVEs named here is in the CISA Known Exploited Vulnerabilities catalog (30 October 2026 edition).
What the vulnerabilities are
strongSwan (DSA-6487-1)
- CVE-2026-78133 (CVSS 7.5): a use-after-free when IKEv2 rekeyings collide and multiple key exchanges are involved. The strongSwan project says an authenticated peer could potentially exploit it for remote code execution. It affects 6.0.0 and later only, so Debian marks bookworm (5.9.8) as not affected.
- CVE-2026-78135 (5.6): CREATE_CHILD_SA requests were not rejected on IKE SAs that were not yet established, which could let an unauthenticated peer set up a usable Child SA before authentication finished. It affects 5.9.7 and later, so bookworm too.
- CVE-2026-78134 (7.1): in the eap-peap and eap-ttls plugins, a client with valid credentials could be bound to another user's identity and, for example, claim their virtual IP. strongSwan says servers that do not accept EAP, or do not use these methods, are not vulnerable.
- CVE-2026-78130 and CVE-2026-78132 (7.5): a crash and an infinite loop in the X.509 attribute-certificate parser. The remaining fixes cover crashes, leaks and loops in PKCS#7 handling, eap-aka and IKE message logging.
OpenVPN (DSA-6376-1, DLA-4666-1)
- CVE-2026-12932 (CVSS 4.0: 7.1) and CVE-2026-13698 (6.0): memory leaks in tls-crypt-v2 key handling that a flood of packets can turn into memory exhaustion.
- CVE-2026-12996 and CVE-2026-13117 (6.0): use-after-free during TLS session promotion that an authenticated peer could use to crash the server or leak heap memory.
- CVE-2026-13122 (5.9): a server using
auth-gen-tokenwithexternal-authcan be stopped by a malformed token. - CVE-2026-11771 (7.0): an off-by-one write in NTLM proxy authentication, reachable from a malicious proxy server (a client-side issue).
Still open: OpenVPN later published CVE-2026-84471 (CVSS 4.0: 7.2), a double-free that extends the CVE-2026-12996 fix and affects 2.6.0 to 2.6.22. The Debian tracker lists both bookworm and trixie as vulnerable, with no update yet.
Are you affected?
dpkg-query -W -f='${Package} ${Version}\n' 'strongswan*' 'charon*' 'libstrongswan*' 'libcharon*' openvpn
apt policy strongswan-libcharon openvpn
sudo grep -rnE 'eap-(ttls|peap|dynamic)' /etc/swanctl /etc/ipsec.conf /etc/strongswan.d 2>/dev/null
sudo grep -rnE 'tls-crypt-v2|auth-gen-token|http-proxy' /etc/openvpn/How to update
sudo apt update
sudo apt install --only-upgrade strongswan strongswan-charon strongswan-libcharon strongswan-starter strongswan-swanctl charon-systemd libstrongswan libstrongswan-standard-plugins libstrongswan-extra-plugins libcharon-extra-plugins libcharon-extauth-plugins openvpnFor strongSwan on bookworm there is nothing new to install yet; follow the strongswan tracker page. Meanwhile, if you do not need EAP-TTLS or EAP-PEAP, do not load those plugins (on Debian, eap-ttls comes from libcharon-extra-plugins), and keep IKE ports reachable only from the peers that need them. For the open OpenVPN issue, restricting who can reach the server port and using tls-crypt or tls-crypt-v2 narrows exposure to holders of a valid key.
Restart or reboot?
No reboot, but restarting a VPN daemon drops active tunnels briefly, so choose a quiet moment:
systemctl list-units 'strongswan*' 'ipsec*' 'openvpn*'
sudo systemctl restart strongswan # charon-systemd / swanctl setups
sudo systemctl restart strongswan-starter # ipsec.conf setups
sudo systemctl restart openvpn-server@server # use your instance nameSources
- security-tracker.debian.org/tracker/DSA-6487-1
- debian.org/security/2026/dsa-6487
- lists.debian.org/debian-security-announce/2026/msg00287.html
- lists.debian.org/debian-security-announce/2026/msg00398.html
- security-tracker.debian.org/tracker/DSA-6376-1
- debian.org/security/2026/dsa-6376
- security-tracker.debian.org/tracker/DLA-4666-1
- lists.debian.org/debian-lts-announce/2026/07/msg00007.html
- security-tracker.debian.org/tracker/DSA-6330-1
- security-tracker.debian.org/tracker/source-package/strongswan
- security-tracker.debian.org/tracker/CVE-2026-78133
- security-tracker.debian.org/tracker/source-package/openvpn
- strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78133).html
- strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78135).html
- strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78134).html
- community.openvpn.net/Security%20Announcements
- community.openvpn.net/Security%20Announcements/CVE-2026-12996
- community.openvpn.net/Security%20Announcements/CVE-2026-84471
- cve.org/CVERecord?id=CVE-2026-78133
- cve.org/CVERecord?id=CVE-2026-12932
- cisa.gov/known-exploited-vulnerabilities-catalog
- packages.debian.org/source/trixie/strongswan
- packages.debian.org/trixie/amd64/libcharon-extra-plugins/filelist
Comments
0 total · 0 threads