IKEv2 Use-After-Free bug when using IKE-over-TCP
Summary
| CVE | CVE-2026-94453 |
|---|---|
| State | PUBLISHED |
| Assigner | libreswan |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-13 22:19:30 UTC |
| Updated | 2026-10-16 19:55:59 UTC |
| Description | Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from d42dc95b-23f1-4e06-9076-20753a0fb0df
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.004540000 probability, percentile 0.379530000 (date 2026-10-16)
Problem Types: CWE-416 | CWE-416 CWE-416: Use After Free
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | d42dc95b-23f1-4e06-9076-20753a0fb0df | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | The Libreswan Project | Libreswan | affected 4.0 5.3.2 semver | Not specified |
| CNA | The Libreswan Project | Libreswan | affected 5.4 5.4 semver | Not specified |
| CNA | The Libreswan Project | Libreswan | unaffected 5.3.3 semver | Not specified |
| CNA | The Libreswan Project | Libreswan | unaffected 5.4.1 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| libreswan.org/security/CVE-2026-94453 | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | |
| libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Vlad Miu (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-09-16T00:00:00.000Z | Libreswan was notified of the issue via [email protected] |
| CNA | 2026-09-24T00:00:00.000Z | Advanced notice given to supported customers and distributions |
| CNA | 2026-10-05T00:00:00.000Z | Public announcement and release of libreswan 5.3.3 and 5.4.1 |
Solutions
CNA: Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-94453/
Workarounds
CNA: To temporarily disable IKE over TCP, set listen-tcp=no.
Exploits
CNA: No known exploitation in the wild. Exploitation requires IKE over TCP to be enabled (listen-tcp=yes). The vulnerability can be triggered remotely without authentication.
There are currently no legacy QID mappings associated with this CVE.