CVE-2023-41913

strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the internal buffer in charon-tkm's DH proxy. The earliest affected version is 5.3.0. An attack can occur via a crafted IKE_SA_INIT message.

• CWE-120
• CWE-120

• https://github.com/strongswan/strongswan/releasesRelease Notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPJZPYHBCRXUQGGKQE6TYH4J4RIJH6HO/
• https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-%28cve-2023-41913%29.htmlVendor Advisory
• https://github.com/strongswan/strongswan/releasesRelease Notes
• https://lists.debian.org/debian-lts-announce/2023/11/msg00018.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPJZPYHBCRXUQGGKQE6TYH4J4RIJH6HO/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YPJZPYHBCRXUQGGKQE6TYH4J4RIJH6HO/
• https://security.netapp.com/advisory/ntap-20250117-0003/
• https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-%28cve-2023-41913%29.htmlVendor Advisory

Published

Dec 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-41905NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cros…5.4
• CVE-2023-41908Cerebrate before 1.15 lacks the Secure attribute for the ses…5.3
• CVE-2023-41909An issue was discovered in FRRouting FRR through 9.0. bgp_nl…7.5
• CVE-2023-4191A vulnerability, which was classified as critical, has been …9.8
• CVE-2023-41910An issue was discovered in lldpd before 1.0.17. By crafting …9.8
• CVE-2023-41911Samsung Mobile Processor Exynos 2200 allows a GPU Double Fre…5.5
• CVE-2023-41914SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.0…7
• CVE-2023-41915OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows att…8.1
• CVE-2023-41916 In Apache Linkis =1.4.0, due to the lack of effective filte…6.5
• CVE-2023-41917Inadequate input validation exposes the system to potential …10
• CVE-2023-41918A vulnerability allows unauthorized access to functionality …10
• CVE-2023-41919Hardcoded credentials are discovered within the application'…9.8