Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Libreswan can crash or be compromised via IKE‑TCP
published 22 days ago
Summary
The Libreswan software may stop working or be taken over when a client using IKE over TCP disconnects and then sends another packet. This can happen only if the configuration enables the listen‑tcp option, and it could let an attacker shut down the service or run their own code. Disable IKE over TCP or update to a newer Libreswan release that fixes the issue.
What to do
- Update libreswan to version 4.15-4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | libreswan |
< 4.15-4 Fix: upgrade to 4.15-4
|
| Azure Linux:3 | azure | libreswan | <= 4.15-3 |
Original advisory text
CVE-2026-94453 affecting package libreswan for versions less than 4.15-4
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.
References
Timeline
Published13 Oct 2026
Updated2 Nov 2026
First seen14 Oct 2026
Sources
AZL-108027 · OSV
Track software like this
Free during beta