PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12413 The Libreswan Project CVE debrief

A vulnerability in Libreswan's IKEv2 fragment handling could allow an attacker to cause a denial of service. The issue arises from an off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) within the reassemble_v2_incoming_fragments() function. This causes the Libreswan pluto daemon to crash and restart upon encountering an invalidly formatted IKEv2 fragment. While no remote code execution is possible, continued exploitation could lead to service disruption. System administrators and security professionals should be aware of this vulnerability and take necessary precautions.

Vendor
The Libreswan Project
Product
libreswan
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-02
Original CVE updated
2026-07-07
Advisory published
2026-07-02
Advisory updated
2026-07-07

Who should care

System administrators and security professionals responsible for IKEv2 connections using Libreswan should be aware of this vulnerability. Any configuration allowing IKEv2 connections without setting fragmentation=no is vulnerable. IKEv1 is not affected. These professionals should review their configurations, monitor for potential exploitation attempts, and apply mitigations as necessary.

Technical summary

The vulnerability exists in the reassemble_v2_incoming_fragments() function of Libreswan's pluto daemon. An invalidly formatted IKEv2 fragment can cause the daemon to crash and restart, leading to a denial of service. The issue is caused by an off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)). No remote code execution is possible. This issue affects configurations allowing IKEv2 connections without setting fragmentation=no. IKEv1 is not affected. Further analysis and testing are required to fully understand the impact and to verify the effectiveness of potential mitigations.

Defensive priority

High

Recommended defensive actions

  • Verify and update Libreswan configurations to set fragmentation=no for IKEv2 connections.
  • Monitor Libreswan logs for crash and restart events.
  • Implement compensating controls to detect and prevent potential exploitation attempts.
  • Review and apply vendor-provided patches or updates.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-07-02T22:16:42.517Z and was last modified on 2026-07-07T18:16:34.153Z. The NVD entry is currently Undergoing Analysis. Official references are available from Libreswan and CVE.org. The vulnerability has been publicly disclosed and its details are being analyzed by the cybersecurity community. Additional information from other sources may become available as the analysis progresses.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-02T22:16:42.517Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.