CVEvulnerability

CVE-2026-12413

7.5 HIGH Published 2026-07-02 Modified 2026-10-25 Official page ↗
Status
Analyzed
Published
2026-07-02
Last modified
2026-10-25
Assigner
d42dc95b-23f1-4e06-9076-20753a0fb0df
CVSS 3.1 (d42dc95b-23f1-4e06-9076-20753a0fb0df)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-193, CWE-617

Description

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.

Affected configurations

• libreswan libreswan (>= 4.6 < 5.3.1)

Related

Weakness · CWE (2)

  • CWE-193 Off-by-one Error weakness
  • CWE-617 Reachable Assertion weakness

References