CVE-2026-94453: Libreswan Pluto Use-After-Free Vulnerability

CVE-2026-94453 Overview

CVE-2026-94453 is a use-after-free vulnerability in the pluto daemon of Libreswan, an IPsec/IKE implementation. The flaw occurs when a client connecting over Internet Key Exchange (IKE) over TCP closes the connection and another packet, either a retransmission or malicious, is received for the same tuple. The IKE state is retained in memory after the client closes the connection, keeping a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. When this invalid pointer is dereferenced, the daemon crashes and restarts. The vulnerability can be triggered before the remote peer authenticates, enabling unauthenticated remote attackers to cause denial of service.

Critical Impact
Unauthenticated remote attackers can repeatedly crash the pluto daemon, causing denial of service of IPsec/VPN infrastructure. Remote code execution may also be possible.

Affected Products

Libreswan pluto daemon configured with listen-tcp=yes
IPsec/IKE deployments accepting IKE over TCP from untrusted networks
Default Libreswan configurations are not affected because IKE over TCP is disabled by default

Discovery Timeline

2026-10-13 - CVE-2026-94453 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-94453

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the Libreswan pluto daemon's handling of IKE over TCP connections. When a client closes its TCP connection, the daemon frees the iface_endpoint structure associated with the connection, but the corresponding IKE Security Association (SA) state retains a dangling pointer at ike_sa.sa->st_iface_endpoint. If a subsequent packet (a legitimate retransmission or an attacker-crafted datagram) arrives matching the same tuple, the daemon dereferences the freed pointer. The result is a crash of the daemon and automatic restart. Repeated triggering produces sustained denial of service for all IPsec peers depending on the daemon. Because the trigger occurs before peer authentication, no credentials or prior trust relationship is required.

Root Cause

The root cause is improper lifecycle management of the iface_endpoint object. When the TCP connection closes, the endpoint resource is freed, but the IKE state object retains the stale reference. The daemon fails to invalidate or clear st_iface_endpoint on connection teardown, so subsequent packet processing operates on freed memory. See the Libreswan CVE-2026-94453 Advisory for complete technical details.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker establishes an IKE over TCP connection to a Libreswan server configured with listen-tcp=yes, closes the TCP session, and then sends an additional packet matching the same connection tuple. This triggers the use-after-free and crashes the pluto process. Scripting the sequence allows an attacker to cause continuous denial of service. The vendor also indicates that remote code execution may be possible under certain conditions, though no public exploit has been reported. Full packet-level details are documented in the Libreswan CVE-2026-94453 Detailed Report.

Detection Methods for CVE-2026-94453

Indicators of Compromise

Repeated pluto daemon crashes and automatic restarts recorded in system logs or systemd journal entries
Unexpected IKE over TCP sessions originating from untrusted sources on TCP port 4500 or configured IKE TCP port
Core dumps generated by the pluto process referencing iface_endpoint or st_iface_endpoint
Spikes in short-lived TCP connections to the IKE service followed by additional packets after FIN/RST

Detection Strategies

Monitor pluto process restarts and alert on frequency exceeding baseline operational norms
Inspect firewall and network sensor telemetry for abnormal TCP teardown patterns on the IKE port
Correlate daemon crash events with inbound traffic from the same source IP within a short time window
Review Libreswan logs for IKE state transitions that complete without peer authentication

Monitoring Recommendations

Forward Libreswan and pluto logs to a centralized logging or SIEM platform for anomaly detection
Alert on service availability loss for IPsec/VPN endpoints and track mean time between restarts
Capture packet metadata for inbound IKE over TCP sessions to support post-incident forensics

How to Mitigate CVE-2026-94453

Immediate Actions Required

Inventory all Libreswan deployments and identify configurations containing listen-tcp=yes
Apply the Libreswan security update as documented in the vendor advisory
Restrict inbound access to the IKE over TCP port using firewall rules that permit only known VPN peers
Monitor daemon stability and investigate any unexplained pluto restarts

Patch Information

Refer to the Libreswan CVE-2026-94453 Advisory for the patched release and upgrade instructions. Administrators should apply the vendor-provided fix on all affected systems and restart the pluto daemon after upgrade.

Workarounds

Disable IKE over TCP by removing or setting listen-tcp=no in the Libreswan configuration if TCP transport is not required
Restrict TCP access to the IKE service to a strict allowlist of trusted peer addresses
Place IKE over TCP endpoints behind a network device that filters unauthenticated TCP sessions

bash

# Example: disable IKE over TCP in ipsec.conf and restart the service
# /etc/ipsec.conf
config setup
    listen-tcp=no

# Apply the change
sudo systemctl restart ipsec