new file mode 100644
@@ -0,0 +1,86 @@
+From d1d29ac675b42a8c4a6454db84803bfecf5a0d99 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Fri, 12 Jun 2026 15:55:43 +0200
+Subject: [PATCH] x509: Fix memory leaks when parsing attribute certificates
+
+This can be triggered by an attribute certificate with lots of GeneralName
+entries or AuthorityKeyIdentifier extensions. There is no verification
+before the certificate is parsed.
+
+Fixes: 3134379ac7f1 ("x509: Fix some whitespaces and do some minor style cleanups in acert")
+Fixes: 26930a8c3e42 ("certificate factory can load certs from file")
+Fixes: CVE-2026-78131
+
+CVE: CVE-2026-78131
+Upstream-Status: Backport [1][2]
+
+[1]https://github.com/strongswan/strongswan/commit/23c9b9a2708e4958292d828424523fa63c0be829
+[2]https://github.com/strongswan/strongswan/commit/9762cc3b091b423543510113a5d05215daf16951
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libstrongswan/plugins/x509/x509_ac.c | 33 +++++++-----------------
+ 1 file changed, 9 insertions(+), 24 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
+index 3fc5de2..68b7cf9 100644
+--- a/src/libstrongswan/plugins/x509/x509_ac.c
++++ b/src/libstrongswan/plugins/x509/x509_ac.c
+@@ -186,41 +186,25 @@ extern bool x509_parse_generalNames(chunk_t blob, int level0, bool implicit,
+ static bool parse_directoryName(chunk_t blob, int level, bool implicit,
+ identification_t **name)
+ {
+- identification_t *directoryName;
+- enumerator_t *enumerator;
+- bool first = TRUE;
+ linked_list_t *list;
+
+ list = linked_list_create();
+ if (!x509_parse_generalNames(blob, level, implicit, list))
+ {
+- list->destroy(list);
++ list->destroy_offset(list, offsetof(identification_t, destroy));
+ return FALSE;
+ }
+-
+- enumerator = list->create_enumerator(list);
+- while (enumerator->enumerate(enumerator, &directoryName))
+- {
+- if (first)
+- {
+- *name = directoryName;
+- first = FALSE;
+- }
+- else
+- {
+- DBG1(DBG_ASN, "more than one directory name - first selected");
+- directoryName->destroy(directoryName);
+- break;
+- }
+- }
+- enumerator->destroy(enumerator);
+- list->destroy(list);
+-
+- if (first)
++ if (list->remove_first(list, (void**)name) != SUCCESS)
+ {
+ DBG1(DBG_ASN, "no directoryName found");
++ list->destroy(list);
+ return FALSE;
+ }
++ if (list->get_count(list))
++ {
++ DBG1(DBG_ASN, "more than one directory name - first selected");
++ }
++ list->destroy_offset(list, offsetof(identification_t, destroy));
+ return TRUE;
+ }
+
+@@ -539,6 +523,7 @@ static bool parse_certificate(private_x509_ac_t *this)
+ DBG2(DBG_ASN, " need to parse crlDistributionPoints");
+ break;
+ case OID_AUTHORITY_KEY_ID:
++ chunk_free(&this->authKeyIdentifier);
+ this->authKeyIdentifier =
+ x509_parse_authorityKeyIdentifier(object,
+ level, &this->authKeySerialNumber);
@@ -16,6 +16,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78127.patch \
file://CVE-2026-78129.patch \
file://CVE-2026-78133.patch \
+ file://CVE-2026-78131.patch \
"
SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c"