johanneslks/cve-2026-35333CVE-2026-35333: strongSwan RADIUS attribute iterator infinite loop PoC
strongSwan RADIUS attribute-iterator pre-auth infinite loop / remote DoS.
attribute_enumerate() in src/libradius/radius_message.c:247-271
accepts RADIUS attributes whose length byte is smaller than
sizeof(rattr_t) (2). For length == 0:
data->len = next->length - sizeof(rattr_t) underflows to (size_t)-2this->left -= next->length is left -= 0 — counter never decreasesthis->next += next->length is next += 0 — pointer never advancesThe enumerator returns the same bogus attribute every iteration,
hanging the caller's while (enumerate(...)) loop.
The DAE receive callback in eap_radius_dae.c calls
request->verify(..., NULL, secret, ...) before dispatching on the
RADIUS code. For code == Access-Request, verify() skips the
Response-Authenticator MD5 check and walks the attribute enumerator
to find Message-Authenticator — so the zero-length attribute traps
the parser before the shared secret is checked. The attack is
unauthenticated.
One UDP packet pegs a charon worker thread at 100% CPU forever. Repeat N times to exhaust all N worker threads.
Affected: strongSwan <= 5.9.13. Fixed in upstream master commit
e067d24293 (2026-04-21).
python3 poc.py --target <charon-host> --port 3799
eap-radius plugin loaded and
dae.enable = yes (UDP/3799 listener)This project is released under the GNU GPLv3.
It is provided for defensive security research, education, and authorized testing. Do not use this code against systems or services without explicit permission from the owner.
Unauthorized use may violate applicable law. The authors do not grant permission to test third-party systems and are not responsible for misuse.
See the LICENSE file for warranty and liability terms.