CVE-2026-35333: Pre-Secret Infinite Loop in strongSwan libradius DAE Handler

Overview

CVE	CVE-2026-35333
Advisory	strongSwan Security Advisory
SUSE	SUSE CVE Entry
Component	src/libradius/radius_message.c (attribute_enumerate())
Affected	strongSwan <= 6.0.5
Fixed	strongSwan 6.0.6
Class	CWE-835 (Infinite Loop), CWE-191 (Integer Underflow)
CVSS v4.0	8.7 (High, SUSE) -- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Found and patched by	Lukas Johannes Moeller (@JohannesLks)

TL;DR

strongSwan's RADIUS attribute iterator accepts a zero-length attribute header, gets stuck re-reading the same byte forever, and hands callers a chunk_t with len = (size_t)-2. One UDP packet is enough to pin a charon worker thread on the Dynamic Authorization Extension (DAE) port. Fixed in strongSwan 6.0.6.

Root Cause

attribute_enumerate() in src/libradius/radius_message.c validated only the outer buffer, not the advertised attribute length:

if (this->left < sizeof(rattr_t) ||
    this->left < this->next->length)
{
    return FALSE;
}

data->len = this->next->length - sizeof(rattr_t);
this->left -= this->next->length;
this->next  = ((void*)this->next) + this->next->length;

For length == 0:

• data->len = 0 - 2 wraps to 0xfffffffffffffffe
• this->left and this->next are unchanged
• the next iterator step re-reads the same attribute

Callers that consume data.len as a count of trusted bytes inherit a near-SIZE_MAX read.

Reachability

The interesting path is eap_radius_dae.c:402. DAE packets arrive over UDP and are parsed before the shared-secret check because verify() itself walks the same enumerator to find Message-Authenticator. A zero-length attribute placed earlier in the packet traps verify() inside the non-advancing loop, so no shared secret is required.

Additional callers exposed to the same iterator: tnc_pdp.c as a RADIUS server, and eap_radius.c / radius_socket.c when strongSwan acts as a RADIUS client and parses responses from a malicious or compromised server.

Impact

• Unauthenticated remote CPU DoS on the DAE listener: one crafted packet can stall one worker thread; repeated packets can exhaust the worker pool.
• size_t underflow to -2 / misaligned reads for callers that trust data.len.
• No code execution demonstrated in our tests; behavior is dominated by non-advancing iteration and thread starvation.

Scoring note: this post now tracks SUSE's CVSS v4.0 rating of 8.7. Empirically, our reproduced exploit effect is denial-of-service.

Proof of Concept

A standalone proof of concept is published on Exploit-DB as EDB-ID 52586 and mirrored at github.com/JohannesLks/CVE-2026-35333. It sends one unauthenticated RADIUS Access-Request to the DAE listener (UDP/3799) carrying a single zero-length attribute; attribute_enumerate() never advances past it, pinning a charon worker thread at 100% CPU with no knowledge of the DAE shared secret.

Fix

strongSwan 6.0.6 rejects attributes whose advertised length is smaller than the header, both at parse time (validate_attributes()) and inside the enumerator:

if (this->next->length < sizeof(rattr_t))
{
    DBG1(DBG_IKE, "RADIUS attribute has invalid length");
    return FALSE;
}

Upgrade RADIUS-facing charon installations to strongSwan 6.0.6.

Credits

strongSwan credits Lukas Johannes Moeller and Haruto Kimura (Stella) for independent discovery.