CVE-2026-94453 The Libreswan Project CVE debrief

Who should care

Defenders responsible for Libreswan deployments, particularly those using IKE over TCP, should assess exposure and prioritize patching or mitigation. System administrators and security teams managing VPN configurations need to verify affected versions and apply necessary updates or compensating controls.

Why it matters

This vulnerability in Libreswan's IKEv2 implementation over TCP can lead to denial of service and potentially remote code execution. Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or compensating controls as needed. The vulnerability can be triggered before remote peer authentication, increasing the risk of exploitation.

• Denial of service through daemon crashes and restarts.
• Potential for remote code execution if exploitation is successful.
• Need for verification of affected versions and configurations.
• Prioritization of patching or applying compensating controls.

Technical summary

The Libreswan pluto daemon has a use-after-free vulnerability when handling IKE over TCP connections. This occurs when a client closes the connection and another packet is received for the same tuple, causing the daemon to crash and restart. The vulnerability can be triggered before remote peer authentication and may lead to denial of service or potentially remote code execution. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts.

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or compensating controls as needed.

Recommended defensive actions

• Verify if the system uses IKE over TCP and if the listen-tcp option is enabled.
• Check if the installed version of Libreswan is affected (versions 4.0 to 5.3.2 or 5.4).
• Apply patches or updates provided by the vendor (e.g., upgrading to version 5.3.3 or 5.4.1).
• Implement compensating controls, such as monitoring for suspicious IKE over TCP activity.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and affected versions. However, additional information on exploitation, victims, or business impact is not available. The vulnerability affects Libreswan's pluto daemon when handling IKE over TCP connections. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. The official CVE Program record and NIST NVD detail page provide source-provided CVE metadata and source-

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.