Commit 49bf0725fa for strongswan.org

commit 49bf0725fa61198d1e29d5b4c2651c9190b2c10c
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Mon Jun 15 16:02:01 2026 +0200

    openssl: Fix memory leaks after enumerating certificates in PKCS#7 container

    This can be triggered via IKEv1.

    Fixes: 04884be3b5f7 ("Implement openssl PKCS#7 certficiate enumeration")
    Fixes: CVE-2026-78124

diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
index 9980bf242c..46584055ec 100644
--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
@@ -132,6 +132,10 @@ typedef struct {
 METHOD(enumerator_t, cert_destroy, void,
 	cert_enumerator_t *this)
 {
+	if (this->certs)
+	{
+		sk_X509_pop_free(this->certs, X509_free);
+	}
 	DESTROY_IF(this->cert);
 	free(this);
 }