{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94453", "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "state": "PUBLISHED", "assignerShortName": "libreswan", "dateReserved": "2026-09-21T17:09:02.116Z", "datePublished": "2026-10-13T21:27:43.376Z", "dateUpdated": "2026-10-16T15:31:54.755Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "shortName": "libreswan", "dateUpdated": "2026-10-13T21:27:43.376Z"}, "title": "IKEv2 Use-After-Free bug when using IKE-over-TCP", "descriptions": [{"lang": "en", "value": "Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected."}], "affected": [{"vendor": "The Libreswan Project", "product": "libreswan", "packageName": "libreswan", "collectionURL": "https://github.com/libreswan/libreswan", "repo": "https://github.com/libreswan/libreswan", "versions": [{"version": "4.0", "status": "affected", "lessThanOrEqual": "5.3.2", "versionType": "semver"}, {"version": "5.4", "status": "affected", "lessThanOrEqual": "5.4", "versionType": "semver"}, {"version": "5.3.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.1", "status": "unaffected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of service and potential remote code execution via use-after-free when processing IKE-over-TCP connections"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}, {"other": {"type": "vendorSeverity", "content": {"value": "HIGH", "description": "Vendor-assessed severity: High. Exploitation does not require authentication. IKE over TCP is not enabled by default but affects any configuration with listen-tcp=yes."}}}], "workarounds": [{"lang": "en", "value": "To temporarily disable IKE over TCP, set listen-tcp=no."}], "solutions": [{"lang": "en", "value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-94453/"}], "exploits": [{"lang": "en", "value": "No known exploitation in the wild. Exploitation requires IKE over TCP to be enabled (listen-tcp=yes). The vulnerability can be triggered remotely without authentication."}], "configurations": [{"lang": "en", "value": "Only configurations with listen-tcp=yes are vulnerable. IKE over TCP is not enabled by default in libreswan."}], "credits": [{"lang": "en", "type": "finder", "value": "Vlad Miu"}], "source": {"discovery": "EXTERNAL", "defects": ["CVE-2026-94453"]}, "references": [{"name": "Libreswan Security Advisory CVE-2026-94453", "url": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt", "tags": ["vendor-advisory"]}, {"name": "Libreswan CVE-2026-94453 Patches", "url": "https://libreswan.org/security/CVE-2026-94453/", "tags": ["patch"]}], "timeline": [{"time": "2026-09-16T00:00:00.000Z", "lang": "en", "value": "Libreswan was notified of the issue via security@libreswan.org"}, {"time": "2026-09-24T00:00:00.000Z", "lang": "en", "value": "Advanced notice given to supported customers and distributions"}, {"time": "2026-10-05T00:00:00.000Z", "lang": "en", "value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"}], "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "15.1", "taxonomyRelations": [{"taxonomyId": "T1499.004", "relationshipName": "maps to", "relationshipValue": "Application or System Exploitation (DoS)"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94453", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:22.083231Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:31:54.755Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/libreswan/libreswan", "defaultStatus": "unaffected", "packageName": "libreswan", "product": "libreswan", "repo": "https://github.com/libreswan/libreswan", "vendor": "The Libreswan Project", "versions": [{"lessThanOrEqual": "5.3.2", "status": "affected", "version": "4.0", "versionType": "semver"}, {"lessThanOrEqual": "5.4", "status": "affected", "version": "5.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.3.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.1", "versionType": "semver"}]}], "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected."}], "id": "CVE-2026-94453", "lastModified": "2026-10-16T19:55:59.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94453", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:14:22.083231Z", "version": "2.0.3"}}]}, "published": "2026-10-13T22:19:30.253", "references": [{"source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "url": "https://libreswan.org/security/CVE-2026-94453/"}, {"source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "url": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt"}], "sourceIdentifier": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "type": "Secondary"}]}

{"bugzilla": {"description": "libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP", "id": "2550254", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550254"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service."], "mitigation": {"lang": "en:us", "value": "If IKE-over-TCP is not required, administrators can temporarily mitigate this vulnerability by setting `listen-tcp=no` in the Libreswan configuration. This disables the vulnerable IKE-over-TCP functionality. \nIf IKE-over-TCP is required, administrators should restrict access to the listener to trusted peers where practical and apply the appropriate security update once available."}, "name": "CVE-2026-94453", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:9::fastdatapath", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Fast Datapath for RHEL 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94453\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94453\nhttps://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt\nhttps://libreswan.org/security/CVE-2026-94453/libreswan-5.3-CVE-2026-94453.patch\nhttps://libreswan.org/security/CVE-2026-94453/libreswan-5.4-CVE-2026-94453.patch"], "statement": "Red Hat Product Security has rated this vulnerability as having an Important security impact. A remote, unauthenticated attacker may exploit a use-after-free in Libreswan's IKE-over-TCP handling before peer authentication to cause the IKE daemon to crash and restart. Repeated exploitation can result in denial of service.\nThe vulnerability affects only configurations that explicitly enable IKE-over-TCP using `listen-tcp=yes`; this option is not enabled by default. Consequently, exposure is limited to systems configured to accept IKE-over-TCP connections.", "threat_severity": "Important"}