CVE-2026-47895: Strongswan

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.

Affected products

• Strongswan Strongswan: from 4.3.3, before 6.0.7 (fixed in 6.0.7)

Published 2026-08-22. Last modified 2026-09-09.