From 01908d59b0a42ccd33c1d7973d35adf78de81243 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 20 Mar 2026 16:28:20 +0100
Subject: [PATCH] NEWS: Add info about CVE-2026-25075

---
 NEWS | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/NEWS b/NEWS
index 452971cf5..28a6af562 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,10 @@
 strongswan-6.0.5
 ----------------
 
+- Fixed a vulnerability in the eap-ttls plugin related to processing EAP-TTLS
+  AVPs that can lead to a resource exhaustion or a crash.
+  This vulnerability has been registered as CVE-2026-25075.
+
 - Added support for forwarding certain ICMP errors even if their source address
   doesn't match the traffic selectors, when running on Linux 6.9+.