libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this fla...

libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this fla...

libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this fla...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150495)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150495 advisory. Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libreswan (UTSA-2026-150485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150485 advisory. Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state...

CLEANSTART-2024-DV25781 out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3

Security vulnerability affects the libreswan package. An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3...

Medium: libreswan

Issue Overview: In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is loaded, a malformed X.509 certificate payload can cause the pluto daemon to abort on an assertion. In FIPS mode, adddecodedcert calls CERTExtractPublicKey...

Amazon Linux 2 : libreswan (ALAS-2026-4068)

The version of libreswan installed on the remote host is prior to 3.25-4.8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4068 advisory. In Libreswan before 5.3.2, when the operating system and Libreswan are running in FIPS mode and at least one CA certificate is...

AlmaLinux 9.6 [TuxCare] Security Update: libreswan Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793271759)

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793271759 advisory. - Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of...

Rocky Linux 9.6 [TuxCare] Security Update: libreswan Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1793271759)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793271759 advisory. - Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of...

SUSE CVE-2026-77206

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a...

SUSE CVE-2026-94453

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet retransmit or malicious is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to...

libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKEAUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The...

libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS

A null pointer dereference flaw was found in Libreswan's PKCS7 certificate payload handling. When processing a crafted IKEv2 IKEAUTH packet containing a PKCS7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash...