IKEv2 Use-After-Free bug when using IKE-over-TCP

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-94453",
    "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
    "assignerShortName": "libreswan",
    "dateUpdated": "2026-10-13T21:27:43.376Z",
    "dateReserved": "2026-09-21T17:09:02.116Z",
    "datePublished": "2026-10-13T21:27:43.376Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "shortName": "libreswan",
        "dateUpdated": "2026-10-13T21:27:43.376Z"
      },
      "title": "IKEv2 Use-After-Free bug when using IKE-over-TCP",
      "descriptions": [
        {
          "lang": "en",
          "value": "Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected."
        }
      ],
      "affected": [
        {
          "vendor": "The Libreswan Project",
          "product": "libreswan",
          "collectionURL": "https://github.com/libreswan/libreswan",
          "packageName": "libreswan",
          "repo": "https://github.com/libreswan/libreswan",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "4.0",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "5.3.2"
            },
            {
              "version": "5.4",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "5.4"
            },
            {
              "version": "5.3.3",
              "status": "unaffected",
              "versionType": "semver"
            },
            {
              "version": "5.4.1",
              "status": "unaffected",
              "versionType": "semver"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-416: Use After Free",
              "cweId": "CWE-416",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt",
          "name": "Libreswan Security Advisory CVE-2026-94453",
          "tags": [
            "vendor-advisory"
          ]
        },
        {
          "url": "https://libreswan.org/security/CVE-2026-94453/",
          "name": "Libreswan CVE-2026-94453 Patches",
          "tags": [
            "patch"
          ]
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of service and potential remote code execution via use-after-free when processing IKE-over-TCP connections"
            }
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ],
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH"
          }
        },
        {}
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Only configurations with listen-tcp=yes are vulnerable. IKE over TCP is not enabled by default in libreswan."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "To temporarily disable IKE over TCP, set listen-tcp=no."
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-94453/"
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "No known exploitation in the wild. Exploitation requires IKE over TCP to be enabled (listen-tcp=yes). The vulnerability can be triggered remotely without authentication."
        }
      ],
      "timeline": [
        {
          "time": "2026-09-16T00:00:00.000Z",
          "lang": "en",
          "value": "Libreswan was notified of the issue via security@libreswan.org"
        },
        {
          "time": "2026-09-24T00:00:00.000Z",
          "lang": "en",
          "value": "Advanced notice given to supported customers and distributions"
        },
        {
          "time": "2026-10-05T00:00:00.000Z",
          "lang": "en",
          "value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Vlad Miu",
          "type": "finder"
        }
      ],
      "taxonomyMappings": [
        {
          "taxonomyName": "ATT&CK",
          "taxonomyVersion": "15.1",
          "taxonomyRelations": [
            {
              "taxonomyId": "T1499.004",
              "relationshipName": "maps to",
              "relationshipValue": "Application or System Exploitation (DoS)"
            }
          ]
        }
      ]
    }
  }
}