Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by libreswan

CVE-2026-94453IKEv2 Use-After-Free bug when using IKE-over-TCP

High 7.5

In plain English

A high-severity use-after-free in libreswan from The Libreswan Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 60.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libreswan5.3.3-1.el10_2ALSA-2026:89923
AlmaLinux:8libreswan4.12-2.el8_10.7ALSA-2026:90492
AlmaLinux:9libreswan4.15-11.el9_8ALSA-2026:89748
AlmaLinux:10libreswan-minimal5.3.3-1.el10_2ALSA-2026:89923
Alpine:v3.23libreswan5.3.3-r0ALPINE-CVE-2026-94453
Alpine:v3.24libreswan5.3.3-r0ALPINE-CVE-2026-94453
Debian:12libreswanno fix listedDEBIAN-CVE-2026-94453
Debian:13libreswanno fix listedDEBIAN-CVE-2026-94453
Rocky Linux:10libreswan0:5.3.3-1.el10_2RLSA-2026:89923
Rocky Linux:8libreswan0:4.12-2.el8_10.7RLSA-2026:90492
Rocky Linux:9libreswan0:4.15-11.el9_8RLSA-2026:89748
Ubuntu:22.04:LTSlibreswanno fix listedUBUNTU-CVE-2026-94453
Ubuntu:24.04:LTSlibreswanno fix listedUBUNTU-CVE-2026-94453
Ubuntu:26.04:LTSlibreswanno fix listedUBUNTU-CVE-2026-94453
Ubuntu:26.10libreswanno fix listedUBUNTU-CVE-2026-94453

Affected products (as reported)

VendorProductVersions
The Libreswan Project libreswan 4.0 – through 5.3.25.4 – through 5.4

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References