strongSwan VPN Denial of Service Vulnerabilities: How to Check, Fix, and Protect Your Ubuntu Server

 

Stop worrying about the next strongSwan CVE. Learn how to check for DoS vulnerabilities (CVE-2026-35328 to 35334), apply the fix with a ready-to-use bash script, and set up iptables fallbacks. Includes practical commands for Ubuntu and a book recommendation to master binary analysis.

What happened ? 

In April 2026, Ubuntu released USN-8196-2 fixing seven DoS and potential RCE vulnerabilities in strongSwan (CVE-2026-35328 through CVE-2026-35334). Attackers could crash your VPN daemon remotely using malformed TLS extensions, PKCS#7 containers, EAP-SIM attributes, or RSA decryption tricks.

But here’s the thing: similar bugs appear every few months. Instead of just patching today, you need a repeatable process to check, fix, and fallback – without panic.

How to check if you are vulnerable (Ubuntu commands)

Run these on any Ubuntu machine running strongSwan

bash

# Check your strongSwan version
ipsec version

# Compare against vulnerable versions:
# Ubuntu 26.04 LTS: strongSwan < 5.9.8-3ubuntu2.1
# Ubuntu 24.04 LTS: strongSwan < 5.9.8-3ubuntu1.2
# Ubuntu 22.04 LTS: strongSwan < 5.9.5-3ubuntu2.4

# Automatically test if your system needs the patch
dpkg -l | grep strongswan | awk '{print $3}'

Quick vulnerability test – if you see version numbers lower than those above, you’re exposed.

Also check if the strongSwan service is running and exposed to untrusted networks:

bash

systemctl status strongswan-starter
ss -tulpn | grep 500   # IKE port
ss -tulpn | grep 4500  # NAT-T port

---

Automation script to apply the fix (Ubuntu bash)

Save this as patch-strongswan-dos.sh and run it as root. It resolves this specific CVE set – and teaches you the structure to automate any future security update.

bash

#!/bin/bash
# strongSwan DoS vulnerability patcher (CVE-2026-35328 to 35334)
# Compatible with Ubuntu 22.04, 24.04, 26.04

set -e

echo "[+] Checking current strongSwan version..."
CURRENT_VER=$(ipsec version | head -1 | awk '{print $3}')
echo "    Found: $CURRENT_VER"

# Backup configs before update
BACKUP_DIR="/root/strongswan-backup-$(date +%Y%m%d)"
mkdir -p $BACKUP_DIR
cp -r /etc/strongswan/ $BACKUP_DIR/ 2>/dev/null || true
echo "[+] Configs backed up to $BACKUP_DIR"

# Update package list and install patched version
echo "[+] Applying security update..."
apt update
apt install --only-upgrade strongswan strongswan-starter strongswan-charon -y

# Verify fix applied
NEW_VER=$(ipsec version | head -1 | awk '{print $3}')
echo "[+] Updated from $CURRENT_VER to $NEW_VER"

# Restart service
systemctl restart strongswan-starter
systemctl status strongswan-starter --no-pager

echo "[+] Patch complete. Check logs: journalctl -u strongswan-starter -n 20"

Why this script matters for the future:

This script solves a specific CVE. To learn how to create your own scripts for any future CVE, you need the book: Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly.

This script solves one CVE. That book teaches you to solve ALL the CVEs you’ve never seen.

Affiliate disclosure: As an Amazon Associate, I earn from qualifying purchases. This helps me keep writing in-depth security guides – at no extra cost to you.).

Alternative mitigation if you can’t update now

Sometimes you cannot reboot or disrupt tunnels. Here are three live mitigations:

1. Block malicious TLS extension probes (iptables

The CVE-2026-35328 attack uses malformed supported_versions TLS extension. Block it at the firewall:

bash

# Block TLS-based strongSwan control port (if you use strongSwan with TLS)
iptables -A INPUT -p tcp --dport 443 -m string --string "supported_versions" --algo bm -j DROP

# Save rules
iptables-save > /etc/iptables/rules.v4

2. Limit EAP-SIM/AKA message rate (CVE-2026-35330)

bash

# Rate-limit RADIUS and EAP packets to prevent flood
iptables -A INPUT -p udp --dport 1812 -m limit --limit 10/s -j ACCEPT
iptables -A INPUT -p udp --dport 1812 -j DROP

3. AppArmor profile to restrict strongSwan (partial RCE protection)

Create /etc/apparmor.d/local/usr.lib.ipsec.charon with:

text

/usr/lib/ipsec/charon {
  deny /tmp/* rw,
  deny /proc/sys/** r,
}

Then reload: apparmor_parser -r /etc/apparmor.d/usr.lib.ipsec.charon

Note: These are temporary band-aids. Updates are the real cure.

Why learn binary analysis instead of just copying patches?

You can run the script above and sleep well tonight. But next month, another CVE will drop. And the month after.

You need to think like the attacker. When you understand how to instrument binaries and analyze memory corruptions, you stop waiting for Ubuntu notices. You write your own detection scripts, fuzz your own VPN stack, and patch live without rebooting.

That’s exactly what Practical Binary Analysis teaches you – from building a disassembler to implementing binary instrumentation for Linux. It’s the difference between being a user of security updates and being the person who writes them.

Conclusion: From Panic to Process – Your Next Step

Here's the hard truth about Linux security: by this time next year, you'll face at least five more CVEs like these strongSwan vulnerabilities. The patch you just applied will be forgotten. The panic of April 2026 will fade. But the process you build today – checking versions, automating fixes, deploying fallback mitigations – will save you hundreds of hours and sleepless nights.

You now have three tools in your hands:

  1. A verification method to know if you're vulnerable in 30 seconds

  2. A production-ready bash script that patches this specific CVE set and serves as a template for every future update

  3. Emergency iptables and AppArmor band-aids when you cannot reboot

But scripts and firewalls are reactive. The difference between a sysadmin who chases CVEs and one who anticipates them is binary literacy. When you understand how memory corruption works, how TLS extensions crash daemons, and how to instrument running binaries, you stop waiting for Ubuntu notices. 

You start writing your own detection rules, fuzzing your own VPN stack, and sleeping better at night.

That's exactly why I recommend Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly. 

This book won't just patch strongSwan – it'll teach you to dissect any binary, find any vulnerability, and build your own security tools. No more relying on others' advisories.

Affiliate disclosure: As an Amazon Associate, I earn from qualifying purchases. This helps me keep writing in-depth security guides – at no extra cost to you.).