REDHAT-BUG-2550256: Null Pointer Dereference

Q: Who can exploit this issue?

Any peer able to initiate an IKEv2 connection to the libreswan pluto daemon can send a malicious IKE_AUTH packet. The peer does not need to be authenticated.

Q: Is EAP configuration required for exposure?

No. The IKEv2 state-machine inconsistency allows the crash to be triggered even when EAP is not configured.

Q: What is the practical impact of successful exploitation?

A malicious packet can crash and restart the pluto daemon. Repeated malicious IKEv2 attempts can cause a denial of service; remote code execution is not possible.

Q: Which versions are affected?

Versions 4.7 through 5.4 are identified as vulnerable, with 5.3.3 and 5.4.1 specifically identified as not vulnerable.

Published Oct 13, 2026

Updated

The Libreswan Project was informed of a Null Pointer Dereference bug in the EAP handling code for authentication that can result in a denial of service against the libreswan pluto daemon.

As a result of inconsistency within the IKEv2 state machine code, a bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The bug results in a crash and restart. No remote code execution is possible. The error is caused by a fall-through error where it incorrectly dereferences ike->sa.steap which is NULL.

An malicious IKEAUTH packet can trigger this bug, meaning the peer need not be authenticated. Continued attempts to use IKEv2 with such malicious payloads can cause a denial of service. No remote code execution is possible.

Vulnerable versions : 4.7 - 5.4 Not vulnerable : 5.3.3, 5.4.1

Affected Software

1 affected component

libreswan Libreswan>=4.7<5.3.3, >=5.4<5.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Libreswan to a version that resolves this vulnerability.
Fixed in 5.3.3
Upgrade
Upgrade Libreswan to a version that resolves this vulnerability.
Fixed in 5.4.1

Event History

Oct 13, 2026

Data Sourced

via Red Hat·07:58 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

Any peer able to initiate an IKEv2 connection to the libreswan pluto daemon can send a malicious IKE_AUTH packet. The peer does not need to be authenticated.

Is EAP configuration required for exposure?

No. The IKEv2 state-machine inconsistency allows the crash to be triggered even when EAP is not configured.

What is the practical impact of successful exploitation?

A malicious packet can crash and restart the pluto daemon. Repeated malicious IKEv2 attempts can cause a denial of service; remote code execution is not possible.

Which versions are affected?

Versions 4.7 through 5.4 are identified as vulnerable, with 5.3.3 and 5.4.1 specifically identified as not vulnerable.

REDHAT-BUG-2550256: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Is EAP configuration required for exposure?

What is the practical impact of successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Is EAP configuration required for exposure?

What is the practical impact of successful exploitation?

Which versions are affected?