Apache-Pluto-3.0.0--CVE-2018-1306

CVE-2018-1306 Apache Pluto 3.0.0 issue in the authorisation logic which lets attacker upload malicious files by tampering HTTP methods. Script written in python3. Usage: python3 ./plutorce.py http://192.168.0.1/ webshell.jsp...

MCPwnfluence

MCPwnfluence — CVE-2026-27825 & CVE-2026-27826 Two critical vulnerabilities in mcp-atlassian, one of the most popular MCP servers in the ecosystem 4.4K+ GitHub stars, 4M+ downloads. Discovered by the team at Pluto Security. The Vulnerabilities CVE| CVSS| Type| Description ---|---|---|---...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this fla...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this fla...

libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this fla...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

OPENSUSE-SU-2026:12470-1 pluto-5.24.5-1.1 on GA media

These are all security issues fixed in the pluto-5.24.5-1.1 package on the GA media of openSUSE Tumbleweed...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150495)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150495 advisory. Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150485 advisory. Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state...

CLEANSTART-2024-DV25781 out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3

Security vulnerability affects the libreswan package. An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3...

Medium: libreswan

Issue Overview: In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.509 certificate payload can cause the pluto daemon to abort on an assertion. In FIPS mode, adddecodedcert calls CERTExtractPublicKey...

Amazon Linux 2 : libreswan (ALAS-2026-4068)

The version of libreswan installed on the remote host is prior to 3.25-4.8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4068 advisory. In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is...

AlmaLinux 9.6 [TuxCare] Security Update: libreswan Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793271759)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793271759 advisory. - Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of...

Rocky Linux 9.6 [TuxCare] Security Update: libreswan Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793271759)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793271759 advisory. - Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of...

SUSE CVE-2026-77206

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a...