CVE-2026-94453: IKEv2 Use-After-Free bug when using IKE-over-TCP

Published Oct 13, 2026

Updated

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to ifaceendpoint inside ikesa.sa->stifaceendpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Affected Software

1 affected component

libreswan Libreswan

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libreswan to a version that resolves this vulnerability.
Fixed in 5.3.3

Event History

Oct 13, 2026

CVE Published

via MITRE·09:27 PM

Data Sourced

via MITRE·09:27 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Only Libreswan configurations that explicitly enable IKE over TCP with listen-tcp=yes are affected. IKE over TCP is not enabled by default.

Does an attacker need VPN credentials or prior authentication?

No. The issue can be triggered before the remote peer authenticates, so an unauthenticated remote client able to connect using IKE over TCP can target an affected daemon.

What conditions trigger the crash?

A client connects over IKE/TCP and closes the connection, then a retransmitted or malicious packet is received for the same tuple. The retained IKE state can then dereference an invalid endpoint pointer, causing pluto to crash and restart.

What can be done if patching is not immediately possible?

Disable IKE over TCP by removing or avoiding listen-tcp=yes. This removes the affected configuration path described for this vulnerability.

How can I determine whether I am exposed?

Review the Libreswan configuration for listen-tcp=yes. Systems without that setting are not affected according to the provided information.