CVE-2009-2185

CVE-2009-2185 is a medium-severity vulnerability in Strongswan with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

• Severity: Medium (CVSS 2.0 base score 5.0)
• EPSS exploit prediction: 2% (82nd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-20
• Affected product: Strongswan
• Published: 2009-06-25
• Last modified: 2026-06-16

Description

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

Frequently asked questions

What is CVE-2009-2185?

The ASN.1 parser (pluto/asn1.c, libstrongswan/asn1/asn1.c, libstrongswan/asn1/asn1_parser.c) in (a) strongSwan 2.8 before 2.8.10, 4.2 before 4.2.16, and 4.3 before 4.3.2; and (b) openSwan 2.6 before 2.6.22 and 2.4 before 2.4.15 allows remote attackers to cause a denial of service (pluto IKE daemon crash) via an X.509 certificate with (1) crafted Relative Distinguished Names (RDNs), (2) a crafted UTCTIME string, or (3) a crafted GENERALIZEDTIME string.

How severe is CVE-2009-2185?

CVE-2009-2185 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2009-2185 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2009-2185?

CVE-2009-2185 primarily affects Strongswan. In total, 56 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2009-2185?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2009-2185 published?

CVE-2009-2185 was published on 2009-06-25 and last updated on 2026-06-16.

References

• http://download.strongswan.org/CHANGES2.txt
• http://download.strongswan.org/CHANGES4.txt
• http://download.strongswan.org/CHANGES42.txt
• http://secunia.com/advisories/35522
• http://secunia.com/advisories/35698
• http://secunia.com/advisories/35740
• http://secunia.com/advisories/35804
• http://secunia.com/advisories/36922
• http://secunia.com/advisories/36950
• http://secunia.com/advisories/37504
• http://up2date.astaro.com/2009/07/up2date_7404_released.html
• http://www.debian.org/security/2009/dsa-1898
• http://www.debian.org/security/2009/dsa-1899
• http://www.ingate.com/Relnote.php?ver=481
• http://www.redhat.com/support/errata/RHSA-2009-1138.html
• http://www.securityfocus.com/bid/35452
• http://www.securitytracker.com/id?1022428
• http://www.vupen.com/english/advisories/2009/1639
• http://www.vupen.com/english/advisories/2009/1706
• http://www.vupen.com/english/advisories/2009/1829
• http://www.vupen.com/english/advisories/2009/3354
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11079
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00264.html
• https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00337.html

Affected products (56)

• cpe:2.3:a:strongswan:strongswan:2.8.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.4:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.5:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.6:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.7:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.8:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.9:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:2.8.10:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.2:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.4:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.5:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.6:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.7:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.8:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.9:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.10:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.11:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.12:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.13:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.14:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.2.15:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:strongswan:strongswan:4.3.1:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.4.1:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.4.2:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.4.3:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.4.4:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.4.5:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.4.9:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.4.10:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.6.03:*:*:*:*:*:*:*
• cpe:2.3:a:xelerance:openswan:2.6.04:*:*:*:*:*:*:*

More vulnerabilities in Strongswan

• CVE-2004-0590 — Critical (CVSS 10.0): FreeS/WAN 1.x and 2.x, and other related products including superfreeswan 1.x, openswan 1.x before 1.0.6, openswan 2.x…
• CVE-2023-41913 — Critical (CVSS 9.8): strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value…
• CVE-2023-26463 — Critical (CVSS 9.8): strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two…
• CVE-2015-3991 — Critical (CVSS 9.8): strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary…
• CVE-2021-45079 — Critical (CVSS 9.1): In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually…
• CVE-2022-4967 — High (CVSS 7.7): strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate…

All CVEs affecting Strongswan →

Other CWE-20 (Improper Input Validation) vulnerabilities

• CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
• CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
• CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →