new file mode 100644
@@ -0,0 +1,42 @@
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Wed, 25 Mar 2026 10:17:46 +0100
+Subject: tls-server: Prevent infinite loop if supported versions are too
+ short
+
+If the extension doesn't contain a multiple of two bytes, the previous
+code would get stuck in an infinite loop as `remaining()` continued to
+return TRUE while `read_uint16()` failed to parse a value. Initiating
+several connections with such an extension allows a DoS attack as no
+threads would eventually be available to handle packets/events.
+
+Fixes: 7fbe2e27ecf6 ("tls-server: TLS 1.3 support for TLS server implementation")
+Fixes: CVE-2026-35328
+
+CVE: CVE-2026-35328
+Upstream-Status: Backport [https://snapshot.debian.org/archive/debian-security-debug/20260422T125423Z/pool/updates/main/s/strongswan/strongswan_6.0.1-6%2Bdeb13u5.debian.tar.xz]
+Signed-off-by: Nitin Wankhade <nitin.wankhade333@gmail.com>
+===
+diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c
+index 3ad9fd2..7b2238e 100644
+--- a/src/libtls/tls_server.c
++++ b/src/libtls/tls_server.c
+@@ -471,15 +471,12 @@ static status_t process_client_hello(private_tls_server_t *this,
+ bio_reader_t *client_versions;
+
+ client_versions = bio_reader_create(versions);
+- while (client_versions->remaining(client_versions))
++ while (client_versions->read_uint16(client_versions, &version))
+ {
+- if (client_versions->read_uint16(client_versions, &version))
++ if (this->tls->set_version(this->tls, version, version))
+ {
+- if (this->tls->set_version(this->tls, version, version))
+- {
+- this->client_version = version;
+- break;
+- }
++ this->client_version = version;
++ break;
+ }
+ }
+ client_versions->destroy(client_versions);
new file mode 100644
@@ -0,0 +1,3 @@
+SRC_URI += "\
+ file://tls-server-Prevent-infinite-loop-if-supported-versio.patch \
+"