CVE-2023-26463

    Dashboard / Vulnerabilities / CVE-2023-26463

    CVE-2023-26463

    Published: 14 Apr 2023Last Modified: 12 Aug 2026

    Summary:

    Details: strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes within the same function. There is initially incorrect access control, later followed by an expired pointer dereference. One attack vector is sending an untrusted client certificate during EAP-TLS. A server is affected only if it loads plugins that implement TLS-based EAP methods (EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-TNC). This is fixed in 5.9.10.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26463.json, https://nvd.nist.gov/vuln/detail/CVE-2023-26463, https://security.netapp.com/advisory/ntap-20230517-0010/, https://github.com/strongswan/strongswan/releases, https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-%28cve-2023-26463%29.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e09bc70d124554f8ee892f3ee4a988ce6d2e7c90
    Fixed -None

    Affected versions

    5.9.8-NA
    5.9.9-NA
    5.9.9
    5.9.9rc2
    5.9.9rc1
    5.9.8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-26463 | CVE-DB