Every CVE Search/ Get API key

CVE-2026-94453

IKEv2 Use-After-Free bug when using IKE-over-TCP

7.5 HighFix available

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.45%Unchanged since Oct 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

IKEv2 Use-After-Free bug when using IKE-over-TCP

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Record
CVE-2026-94453
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-100744 7.5

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Record
EUVD-2026-100744
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-59fc-px6w-3g8v 7.5

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE...

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Record
GHSA-59fc-px6w-3g8v
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
NVD 7.5

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Record
CVE-2026-94453
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2026-94453 7.5

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Record
ALPINE-CVE-2026-94453
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVDEBIAN-CVE-2026-94453 7.5

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Record
DEBIAN-CVE-2026-94453
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
Show 8 moreShow less
OSVRLSA-2026:89748 7.5

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)

  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)

  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89748
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:89923 7.5

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)

  • libreswan: Denial of Service via sending bogus X.509 certificates (CVE-2026-77205)

  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89923
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:90492 7.5

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)

  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)

  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:90492
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-94453 7.5

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Record
UBUNTU-CVE-2026-94453
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:89748 No score

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89748
Updated
2026-11-02
OSVALSA-2026:89923 No score

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
  • libreswan: Denial of Service via sending bogus X.509 certificates (CVE-2026-77205)
  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89923
Updated
2026-11-02
OSVALSA-2026:90492 No score

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:90492
Updated
2026-11-02
OSVAZL-108027 No score

CVE-2026-94453 affecting package libreswan for versions less than 4.15-4

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Record
AZL-108027
Updated
2026-11-05

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libreswan
Alpine:v3.23
 before 5.3.3-r0
5.3.3-r0
libreswan
Alpine:v3.24
 before 5.3.3-r0
5.3.3-r0
libreswan
AlmaLinux:9
From an advisory covering 3 CVEs
 before 4.15-11.el9_8
4.15-11.el9_8
libreswan
AlmaLinux:10
From an advisory covering 3 CVEs
 before 5.3.3-1.el10_2
5.3.3-1.el10_2
libreswan-minimal
AlmaLinux:10
From an advisory covering 3 CVEs
 before 5.3.3-1.el10_2
5.3.3-1.el10_2
libreswan
AlmaLinux:8
From an advisory covering 3 CVEs
 before 4.12-2.el8_10.7
4.12-2.el8_10.7
libreswan
Azure Linux:3
 before 4.15-4
4.15-4
libreswan
Debian:12
 All versions, plus listed versions
4.10-24.10-2+deb12u14.11-14.12-14.12-2
Show 13 moreShow less
4.12-34.14-14.14-1.14.15-15.0~rc2-15.0~rc2-25.2-15.2-25.2-2.15.2-2.25.2-2.35.2-2.45.2-2.5
 None known
libreswan
Debian:13
 All versions, plus listed versions
5.2-2.25.2-2.35.2-2.45.2-2.5
 None known
libreswan
Rocky Linux:9
From an advisory covering 3 CVEs
 before 0:4.15-11.el9_8
0:4.15-11.el9_8
Show 8 moreShow less
Affected packages
PackageAffectedFixed
libreswan
Rocky Linux:10
From an advisory covering 3 CVEs
 before 0:5.3.3-1.el10_2
0:5.3.3-1.el10_2
libreswan
Rocky Linux:8
From an advisory covering 3 CVEs
 before 0:4.12-2.el8_10.7
0:4.12-2.el8_10.7
libreswan
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.20-7build13.21-23.22-13.22-23.22-33.22-43.23-13.23-4
 None known
libreswan
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.29-23.29-2build1
 None known
libreswan
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.32-3ubuntu3
 None known
libreswan
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.11-1ubuntu14.12-1ubuntu14.14-1ubuntu14.14-1ubuntu2
 None known
libreswan
Ubuntu:26.10
 All versions, plus listed versions
5.2-2.2ubuntu2
 None known
libreswan
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.2-2.2ubuntu15.2-2.2ubuntu2
 None known

History

History
RecordedChangedSources
affected
affectedOSV
factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-94453 is a high vulnerability (CVSS 7.5) in The Libreswan Project Libreswan, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in libreswan 5.3.3-r0.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open