new file mode 100644
@@ -0,0 +1,51 @@
+From 4dae392b32a2c56441fd7ca50ad32a0874455995 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Fri, 19 Jun 2026 11:57:48 +0200
+Subject: [PATCH] x509: Avoid NULL-pointer dereference if issuerName is missing
+ in attribute certificate
+
+If neither authoritiyKeyIdentifier nor issuerName are encoded in an
+attribute certificate, the validation in `acert_validator.c:verify()`
+will cause a NULL-pointer dereference via `issued_by()` (the lookup
+with NULL identity will enumerate all trusted certificates).
+
+Fixes: 26930a8c3e42 ("certificate factory can load certs from file")
+Fixes: CVE-2026-78130
+CVE: CVE-2026-78130
+Upstream-Status: Backport [https://download.strongswan.org/security/CVE-2026-78130/]
+Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
+
+---
+ src/libstrongswan/plugins/x509/x509_ac.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
+index 4fa9f6d0a3e0..4436bc4debef 100644
+--- a/src/libstrongswan/plugins/x509/x509_ac.c
++++ b/src/libstrongswan/plugins/x509/x509_ac.c
+@@ -897,7 +897,11 @@ METHOD(certificate_t, has_issuer, id_match_t,
+ {
+ return ID_MATCH_PERFECT;
+ }
+- return this->issuerName->matches(this->issuerName, issuer);
++ if (this->issuerName)
++ {
++ return this->issuerName->matches(this->issuerName, issuer);
++ }
++ return ID_MATCH_NONE;
+ }
+
+ METHOD(certificate_t, issued_by, bool,
+@@ -934,7 +938,8 @@ METHOD(certificate_t, issued_by, bool,
+ }
+ else
+ {
+- if (!this->issuerName->equals(this->issuerName,
++ if (!this->issuerName ||
++ !this->issuerName->equals(this->issuerName,
+ issuer->get_subject(issuer)))
+ {
+ return FALSE;
+--
+2.43.0
+
@@ -15,6 +15,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78126.patch \
file://CVE-2026-78127.patch \
file://CVE-2026-78129.patch \
+ file://CVE-2026-78130.patch \
"
SRC_URI[sha256sum] = "07df7cedae56a7f3bb07e66d21a1f9f87e961db70e99184e11d3819413e4f87c"
strongSwan (since 4.2.0, through 6.0.7) allows a denial of service in the x509 plugin related to the verification of X.509 attribute certificates. Reference: [https://nvd.nist.gov/vuln/detail/cve-2026-78130] [https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78130).html] [https://security-tracker.debian.org/tracker/CVE-2026-78130] Upstream Patch: [https://download.strongswan.org/security/CVE-2026-78130/] Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com> --- .../strongswan/CVE-2026-78130.patch | 51 +++++++++++++++++++ .../strongswan/strongswan_6.0.6.bb | 1 + 2 files changed, 52 insertions(+) create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch