IKEv2 Use-After-Free bug when using IKE-over-TCP
CVSS score
7.5
EPSS probability
—
Risk score
0.8
Published
11 h ago
Etkilenen ürün ve sürüm için yayımlanan güvenlik güncellemesini uygulayın.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
1
Source agreement
Tam uyum
Evidence confidence
%55
Short explanation
Libreswan's pluto daemon contains a use-after-free vulnerability when using IKE over TCP [S0]. This issue can be triggered before authentication by the remote peer [S0]. Continued exploitation can lead to a denial of service and potential remote code execution [S0].
This vulnerability matters because it can be triggered remotely without authentication and may lead to service disruption [S0].
What should be done?
- Follow vendor security advisory [S0]
- Apply patch references [S0]
- Review listen-tcp configuration [S0]
Chain of evidence and sources
Libreswan pluto daemon bileşeni, IKE over TCP bağlantısı kapatılıp aynı tıkız için ek paket alındığında kullanım sonrası serbest bırakma hatası barındırır.
Söz konusu zafiyet, uzak eş kimlik doğrulamasını tamamlamadan önce tetiklenebilir ve hizmet dışı kalmaya yol açabilir.
Bu zafiyet yalnızca listen-tcp=yes içeren konfigürasyonları etkiler.
Show the technical text from the sources
Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-416
Explanation produced with the local gemini-flash-lite-latest model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-94453 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | The Libreswan Project | libreswan | View |
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 7.5 | CVSS V31 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD |
| 7.5 | CVSS V3_1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CVE CNA |
Patch and Remediation Guide
Solution & Remediation Advisory
2 doğrulanmış yama veya düzeltilmiş sürüm kanıtı bulundu.
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-94453 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-94453 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
CVSS Vector Radar Chart
7.5 / 10Vulnerability Scoring Details
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HYama doğrulandı
Weakness Type (CWE & CAPEC)
Similar Vulnerabilities
Null Pointer Dereference in PKCS#7 bundle with no certificates
IKEv2 pre-authentication Null Pointer Dereference in EAP code
Denial of Service via sending bogus X.509 certificates
FIPS mode assertion failure via malicious CERT payload
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-94453"