{"id":"CVE-2016-5361","aliases":["EUVD-2016-6312","GHSA-pvgh-6wjg-x887","RHSA-2016:2603"],"status":"published","title":"programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which...","description":"programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02724,"percentile":0.86135,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-06-16T14:00:00Z","modified":"2026-10-20T13:15:52Z","fixes":[{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libreswan","fixed_in":["0:3.15-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libreswan-debuginfo","fixed_in":["0:3.15-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libreswan","fixed_in":["0:3.15-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libreswan-debuginfo","fixed_in":["0:3.15-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libreswan","fixed_in":["0:3.15-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libreswan-debuginfo","fixed_in":["0:3.15-8.el7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.15-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.15-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.15-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.15-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.15-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.15-8.el7"}]}]}],"products":[{"vendor":"libreswan","product":"libreswan"}],"references":[{"url":"https://lists.libreswan.org/pipermail/swan-dev/2016-March/001394.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2603.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://github.com/libreswan/libreswan/commit/152d6d95632d8b9477c170f1de99bcd86d7fb1d6","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2016/06/10/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5361","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pvgh-6wjg-x887"},{"url":"https://access.redhat.com/errata/RHSA-2016:2603","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://www.kb.cert.org/vuls/id/419128","tags":["advisory"]},{"url":"https://libreswan.org/security/CVE-2016-5361/CVE-2016-5361.txt","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1190526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1219049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1229766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1257079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1272112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1278063","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1280449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1283468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1290907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1297816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1308508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1309764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1313747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1315412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1347735","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2603.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-5361","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5361","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-5361","description":"programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.","status":"published","published":"2016-06-16T14:00:00Z","modified":"2024-08-06T01:01:00.153Z","updated_at":"2026-11-02T14:33:30.767029Z"}],"euvd":[{"id":"EUVD-2016-6312","description":"programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.","status":"published","published":"2016-06-16T14:00:00Z","modified":"2024-08-06T01:01:00Z","updated_at":"2026-11-03T02:22:42.442421Z"}],"ghsa":[{"id":"GHSA-pvgh-6wjg-x887","title":"programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which...","description":"programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.","status":"published","published":"2022-05-17T03:04:55Z","modified":"2023-01-27T05:06:09Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:42:50.976174Z"}],"nvd":[{"id":"CVE-2016-5361","description":"programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.","status":"published","published":"2016-06-16T14:59:51.89Z","modified":"2026-06-17T00:49:17.09Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-5361","description":"programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.","status":"published","published":"2016-06-16T14:59:51.89Z","modified":"2026-10-20T13:15:52.866966593Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"RHSA-2016:2603","title":"Red Hat Security Advisory: libreswan security and bug fix update","status":"published","published":"2024-09-15T23:33:22Z","modified":"2026-06-26T10:32:12Z","updated_at":"2026-11-02T15:53:03.734507Z"}]}}