CVE-2026-94453
7.5HighPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-416
Impact
Unauthenticated remote attackers can crash the Libreswan pluto daemon repeatedly to cause a denial of service, with potential remote code execution. They only need network access to send packets over an open IKE TCP port.
Root cause
A use-after-free occurs when an IKE-over-TCP connection closes and retains a dangling pointer to an endpoint structure that gets reused upon receiving subsequent packets for the same tuple.
Affected systems
Libreswan with listen-tcp=yes enabled; specific version numbers are not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the patched Libreswan version noted in the vendor advisory, or immediately mitigate by setting listen-tcp=no in your ipsec.conf and restarting pluto.
$ grep -rn 'listen-tcp=yes' /etc/ipsec.conf /etc/ipsec.d/AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.