CVE-2026-12413

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments() would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.

References

Affected packages

Git / github.com/libreswan/libreswan

Affected ranges

Type

GIT

Repo

https://github.com/libreswan/libreswan

Events

Introduced

5cb4ea71800792204de69a9f546ca6a41f377bf3

Fixed

de24519eb4ff49803a21d75e880c87834cf33beb

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.6"
        },
        {
            "fixed": "5.3.1"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:libreswan:libreswan:*:*:*:*:*:*:*:*"
}

Affected versions

v4.*

v4.6

v4.7

v4.8

v4.9

v5.*

v5.0rc1

v5.0rc2

v5.1

v5.2

v5.3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-12413.json"