Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-94453— IKEv2 Use-After-Free bug when using IKE-over-TCP

Quick assessment

Affected
The Libreswan Project libreswan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Libreswan 的 pluto 守护进程在处理通过 TCP 连接 IKE（Internet Key Exchange）的客户端时，存在一个使用后释放（use-after-free）漏洞。当客户端关闭连接后，若针对相同五元组（tuple）收到另一个数据包（例如重传包或恶意构造的包），就会触发该漏洞。 在客户端关闭连接后，IKE 状态仍保留在内存中，其中 字段存储了一个指向 结构的指针。一旦对该无效指针进行访问或引用，pluto 守护进程将崩溃并重启。 该漏洞可在远程对等方完成身份认证之前被触发。持续利用此漏洞可导

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-94453

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
IKEv2 Use-After-Free bug when using IKE-over-TCP
Source: CVE Program / CVE List V5
Vulnerability Description
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
释放后使用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
The Libreswan Project libreswan 4.0 ~ 5.3.2 -

II. Public POCs for CVE-2026-94453

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-94453

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-94453 (2)

Same Patch Batch · The Libreswan Project · 2026-10-13 · 4 CVEs total

CVE-2026-77206 7.5 HIGH IKEv2 pre-authentication Null Pointer Dereference in EAP code
CVE-2026-77207 7.5 HIGH Null Pointer Dereference in PKCS#7 bundle with no certificates
CVE-2026-77205 3.7 LOW Denial of Service via sending bogus X.509 certificates

IV. Related Vulnerabilities

Same product: libreswan
Same vendor: The Libreswan Project
Same weakness: CWE-416

V. Comments for CVE-2026-94453

No comments yet

Leave a comment