CVE-2026-12413 The Libreswan Project CVE debrief

Who should care

System administrators and security professionals responsible for IKEv2 connections using Libreswan should be aware of this vulnerability. Any configuration allowing IKEv2 connections without setting fragmentation=no is vulnerable. IKEv1 is not affected. These professionals should review their configurations, monitor for potential exploitation attempts, and apply mitigations as necessary.

Technical summary

The vulnerability exists in the reassemble_v2_incoming_fragments() function of Libreswan's pluto daemon. An invalidly formatted IKEv2 fragment can cause the daemon to crash and restart, leading to a denial of service. The issue is caused by an off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)). No remote code execution is possible. This issue affects configurations allowing IKEv2 connections without setting fragmentation=no. IKEv1 is not affected. Further analysis and testing are required to fully understand the impact and to verify the effectiveness of potential mitigations.

Defensive priority

High

Recommended defensive actions

• Verify and update Libreswan configurations to set fragmentation=no for IKEv2 connections.
• Monitor Libreswan logs for crash and restart events.
• Implement compensating controls to detect and prevent potential exploitation attempts.
• Review and apply vendor-provided patches or updates.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-07-02T22:16:42.517Z and was last modified on 2026-07-07T18:16:34.153Z. The NVD entry is currently Undergoing Analysis. Official references are available from Libreswan and CVE.org. The vulnerability has been publicly disclosed and its details are being analyzed by the cybersecurity community. Additional information from other sources may become available as the analysis progresses.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.