CVE-2009-1958: charon/sa/tasks/child_create.c in the charon daemon in strongSWAN before 4.3.1 switches the NULL checks for...

Security readout for executives and security teams

This is a remote denial-of-service issue in strongSWAN's charon IKE daemon. A malformed IKE_AUTH request missing expected traffic selector fields can crash or disrupt service on affected versions. The business risk is VPN availability, not data theft or code execution based on the provided sources. Exposure is most likely on legacy strongSWAN IPsec VPN gateways running charon before 4.3.1, especially where IKE is reachable from untrusted networks. Current, vendor-maintained systems are less likely exposed, but embedded or long-lived VPN appliances should be checked. Prioritize remediation if legacy strongSWAN VPN gateways remain internet-facing or support critical remote access. If no affected versions are present, track as closed with evidence. This is mainly a resilience and uptime issue, not a confirmed breach indicator. Mitigation focus: Inventory strongSWAN charon deployments and record exact package or upstream versions.; Upgrade affected strongSWAN installations to 4.3.1 or vendor-fixed packages.; Apply Debian DSA-1899 or SUSE advisory updates where those distributions manage strongSWAN..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.