diff --git a/src/libstrongswan/networking/streams/stream_vsock.c b/src/libstrongswan/networking/streams/stream_vsock.c
index 4cfab426e..5a2eed5ca 100644
--- a/src/libstrongswan/networking/streams/stream_vsock.c
+++ b/src/libstrongswan/networking/streams/stream_vsock.c
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2024 Tobias Brunner
  * Copyright (C) 2024 Thomas Egerer
  *
  * Copyright (C) secunet Security Networks AG
@@ -40,7 +41,15 @@ static int stream_parse_uri_vsock(char *uri, struct sockaddr_vm *addr)
 	}
 
 	uri += strlen("vsock://");
-	cid = strtoul(uri, &uri, 10);
+	if (*uri == '*')
+	{
+		cid = VMADDR_CID_ANY;
+		uri++;
+	}
+	else
+	{
+		cid = strtoul(uri, &uri, 10);
+	}
 
 	if (*uri != ':' || cid > UINT_MAX)
 	{
diff --git a/src/libstrongswan/networking/streams/stream_vsock.h b/src/libstrongswan/networking/streams/stream_vsock.h
index 14ef11a0f..3950a9ae5 100644
--- a/src/libstrongswan/networking/streams/stream_vsock.h
+++ b/src/libstrongswan/networking/streams/stream_vsock.h
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2024 Tobias Brunner
  * Copyright (C) 2024 Thomas Egerer
  *
  * Copyright (C) secunet Security Networks AG
@@ -29,7 +30,10 @@
  * identifier, CID), followed by a colon separated port. CID as well as port
  * are 32-bit unsigned integers. A full VSOCK uri looks something like:
  *
- *   vsock://2:12345
+ * * vsock://1:12345 (loopback)
+ * * vsock://2:12345 (connect from the VM to the well-known CID of the host)
+ * * vsock://3:12345 (CID 3 as assigned to a VM)
+ * * vsock://\htmlonly\endhtmlonly*:12345 (listen on any CID)
  *
  * There is no default port, so a colon after vsock:// is mandatory.
  *