CVE-2026-94453

Received Received - Intake

Use-After-Free in Libreswan pluto Daemon

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Libreswan Project

Description

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94453

EUVD

EUVD-2026-100744

Affected Vendors & Products

Vendor	Product	Version / Range
The	Libreswan	Project libreswan 4.0
The	Libreswan	Project libreswan 5.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

Libreswan's pluto daemon has a use-after-free vulnerability when a client connects using IKE over TCP and closes the connection while another packet is received for the same connection tuple. The daemon retains IKE state in memory, including a pointer to a freed iface_endpoint. Using this invalid pointer causes the daemon to crash and restart. This can be exploited before authentication, leading to denial of service or potentially remote code execution. The vulnerability only affects systems with IKE over TCP enabled via listen-tcp=yes.

The issue arises because the daemon does not properly clean up state after a client disconnects, leaving dangling pointers that can be triggered by subsequent packets.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in the Libreswan pluto daemon after IKE over TCP connections are closed. Check system logs for pluto daemon crashes or restarts. Use netstat or ss to monitor active IKE over TCP connections on port 500 or custom ports. Enable debug logging in Libreswan to capture connection closure events.

Impact Analysis

This vulnerability can cause your Libreswan VPN server to crash repeatedly, disrupting VPN services and causing downtime. Attackers could exploit it to crash the server without authentication, leading to denial of service. In rare cases, remote code execution may be possible, potentially allowing attackers to take control of the server.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that violate availability requirements in GDPR or HIPAA. Repeated crashes may lead to unauthorized access or data breaches if exploited, potentially violating confidentiality and integrity requirements. Organizations must address this to maintain compliance.

Mitigation Strategies

Disable IKE over TCP by setting listen-tcp=no in Libreswan configuration. Update Libreswan to the latest patched version. Restart the pluto daemon to apply changes. Monitor for any ongoing exploitation attempts or crashes.

Hi! I’m here to help you understand CVE-2026-94453. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70