CVE-2026-12413: IKEv2 Denial of Service via malformed fragmentation
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments() would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digestroof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.
Other sources
IKEv2 Denial of Service via malformed fragmentation
— Microsoft
The Libreswan Project was notified of an issue when it receives an invalidly formatted IKEv2 fragment causing the server to crash and restart. A continued stream of such packets would cause a denial of service.
Severity : Medium Vulnerable versions : 4.6 - 5.3 Not vulnerable : 5.3.1 or later
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.15-2 - Upgrade
Upgrade
libreswanto a version that resolves this vulnerability.Fixed in 5.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12413?
CVE-2026-12413 has a high severity rating of 7.5.
What types of attacks can exploit CVE-2026-12413?
CVE-2026-12413 can be exploited through malformed IKEv2 fragments leading to denial of service.
How does CVE-2026-12413 affect Libreswan?
CVE-2026-12413 causes the Libreswan pluto daemon to crash and restart upon exploitation.
How can I mitigate the risk of CVE-2026-12413?
To mitigate CVE-2026-12413, ensure that you are using the latest updated version of Libreswan.
What is the potential impact of CVE-2026-12413 if exploited?
The potential impact of CVE-2026-12413 includes a complete denial of service for users relying on Libreswan.