CVE-2026-94453IKEv2 Use-After-Free bug when using IKE-over-TCP
Updated under an hour ago ()
Does this affect you?
It affects The Libreswan Project libreswan. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.45%, higher than 38% of scored CVEs.
Do this next
Free account, 1 product
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-416
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.45% (percentile 38)
- Assigned by
- libreswan
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 13, 2026
Affected products
The Libreswan Project libreswan libreswan_project:libreswan (from the name) | from 4.0 through 5.3.2; from 5.4 through 5.4; 5.3.3 not affected; 5.4.1 not affected | CNA record |
References
- https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txtvendor-advisory
- https://libreswan.org/security/CVE-2026-94453/patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.