Libreswan

Libreswan 4.75.3.2/5.4: Null Pointer Deref in IKE CERT PKCS#7 Handler
CVE-2026-77207 7.5 - High - October 13, 2026

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

NULL Pointer Dereference

Libreswan IKEv2 State Machine Nullptr (5.4.1) DoS
CVE-2026-77206 7.5 - High - October 13, 2026

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

NULL Pointer Dereference

Libreswan FIPS Mode NSS Cache Leak Causing Certificate Lockout (5.3.2)
CVE-2026-77205 3.7 - Low - October 13, 2026

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.

Missing Release of Resource after Effective Lifetime

Libreswan pluto UAF via IKE over TCP (5.4) DoS/possible RCE
CVE-2026-94453 7.5 - High - October 13, 2026

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Dangling pointer

Libreswan 5.3: Improper RSA PKCS1 v1.5 verification leads to impersonation/DoS
CVE-2026-50722 7.5 - High - July 02, 2026

Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.

Improper Verification of Cryptographic Signature

Libreswan IKEv1 AES-GMAC Crash via Missing esp Line
CVE-2024-3652 6.5 - Medium - April 11, 2024

The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.

Improper Resource Shutdown or Release

Libreswan IKEv2 PSK Misconfig Crash leads to DoS
CVE-2024-2357 - March 11, 2024

The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys (authby=secret) and the connection cannot find a matching configured secret. When such a connection is automatically added on startup using the auto= keyword, it can cause repeated crashes leading to a Denial of Service.

Null Pointer Deref in Libreswan 3.x/4.x Before 4.12 (pluto IKEv1)
CVE-2023-38712 6.5 - Medium - August 25, 2023

An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart.

NULL Pointer Dereference

Libreswan <4.12 Crash due to Invalid IKEv2 REKEY Protocol ID in pluto daemon
CVE-2023-38710 6.5 - Medium - August 25, 2023

An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20.

Libreswan <4.12 NULL Pointer Crash in IKEv1 Quick Mode (ID_FQDN)
CVE-2023-38711 6.5 - Medium - August 25, 2023

An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6.

NULL Pointer Dereference

Libreswan <4.11 IKEv1 Aggressive Mode DoS via Unauthenticated SPI Mishandling
CVE-2023-30570 7.5 - High - May 29, 2023

pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.

Resource Exhaustion

Libreswan: IKEv1 AM SPI Reuse Crash (CVE-2023-2295)
CVE-2023-2295 7.5 - High - May 17, 2023

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Libreswan 4.9 DoS via TS Payload Selector Length Attack
CVE-2023-23009 6.5 - Medium - February 21, 2023

Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.

Resource Exhaustion

Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects
CVE-2022-23094 7.5 - High - January 15, 2022

Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6.

NULL Pointer Dereference

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan
CVE-2020-1763 7.5 - High - May 12, 2020

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.

Out-of-bounds Read

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets
CVE-2019-10155 3.1 - Low - June 12, 2019

The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29.

Improper Input Validation

In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart
CVE-2019-12312 - May 24, 2019

In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference leading to a restart of libreswan.

libreswan before 3.18
CVE-2016-5391 7.5 - High - June 13, 2017

libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart).

NULL Pointer Dereference

The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS
CVE-2015-3240 - November 09, 2015

The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH g^x value in a KE payload in a IKE packet.

Numeric Errors

libreswan 3.9 through 3.12
CVE-2015-3204 - July 01, 2015

libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK.

Improper Input Validation