Vulnerability details

CVE-2026-12413

The Libreswan Project libreswan

IKEv2 Denial of Service via malformed fragmentation

CVSS 3.1

7.5High

Official description

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.

CVSS scores

Score	Version	Source	Vector
7.5High	3.1	CVEProject cvelistV5 (CNA) (libreswan)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Affected products

Vendor	Product	Versions	Source
The Libreswan Project	libreswan	4.6 ≤ v ≤ 5.3	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-03
Last updated: 2026-07-07
State: Published
Assigner (CNA): libreswan

Exploit prediction (EPSS)

0.59%

Probability of exploitation in 30 days

48.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-193
Off-by-one Error
CWE-617
Reachable Assertion