EUVD-2026-100744
GHSA-59fc-px6w-3g8v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IKE/IPsec listener over network
-
ExploitSend crafted IKE packet
-
ExecutionTrigger use-after-free in pluto
-
ImpactDaemon crash / VPN outage
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to a running libreswan/pluto IKE listener (default UDP 500/4500) with IPsec negotiation enabled - i.e. a configured VPN endpoint; the CVSS PR:N/UI:N indicates no authentication or user interaction is needed, so any host that accepts IKE packets is exposable. The primary limiting factors are exposure of the IKE service (hosts that do not run libreswan as an IPsec responder, or that firewall UDP 500/4500 to trusted peers only, are not reachable) and the specific affected version range below the 5.3.3-r0 Alpine fix; impact is confined to availability (daemon/VPN crash), not data compromise. |
| Impact | The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with a pure availability impact (C:N/I:N/A:H) - i.e. a remote denial-of-service against the IPsec daemon, consistent with CWE-416 Use After Free in a packet-parsing path. This is a notable conflict with the supplied Tags, which list 'Information Disclosure' and 'Memory Corruption': the CVSS vector asserts NO confidentiality or integrity impact, so the 'Information Disclosure' label is not supported by the scored vector and should be verified against the libreswan advisory before being treated as fact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Net assessment: a genuine, remotely triggerable DoS in a VPN gateway daemon is operationally significant (VPN termination is availability-critical), but absent EPSS/KEV/POC signals this is a patch-on-normal-cycle priority rather than an emergency; the 7.5 is driven entirely by availability, not data exposure. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted IKE/IPsec packets to an internet-facing libreswan (pluto) daemon, triggering a use-after-free in the parsing/state-handling code that crashes or destabilizes the daemon. This tears down VPN connectivity for all tunnels terminated on the host. No public proof-of-concept is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
A use-after-free (CWE-416) in Libreswan's IKE daemon allows unauthenticated remote attackers to crash the service, causing a denial of service against the affected IPsec/VPN endpoint; the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5) confirms a network-reachable, low-complexity, no-authentication flaw with impact limited to availability. Affected deployments are Alpine Linux hosts shipping a Libreswan package older than the fixed 5.3.3-r0 build and running the daemon as an IPsec responder - that is, any host that accepts IKE negotiation on the default UDP ports 500 and 4500 without restricting them to trusted peers. Hosts that do not run Libreswan as a responder, or that firewall UDP 500/4500 to known peers, are not reachable and are not exposed; no public exploit identified at time of analysis, and while the advisory tags mention information disclosure alongside use-after-free and memory corruption, the authoritative assessment scopes the impact to a daemon/VPN crash rather than data compromise.
Earlier versions of this analysis (1)
Alpine Linux has published a package fix (libreswan 5.3.3-r0) for CVE-2026-94453, but the advisory itself carries no description of the underlying defect, so the concrete attacker capability cannot be stated from available data. Because libreswan is the IKE/IPsec key-exchange daemon, any exposure is bounded to hosts that actually run it as a VPN or IPsec endpoint and are reachable on the IKE ports (UDP/500 and UDP/4500 for NAT-T) - Alpine systems that merely have the package installed but do not operate an IKE listener are not meaningfully exposed. There is no CVSS vector, CWE, EPSS score, KEV listing, or POC signal in the provided intelligence, and no public exploit identified at time of analysis; authentication requirements are not confirmed from available data. The one actionable fact is that a patched package exists and should be applied.
RemediationAI
Vendor-released patch: upgrade the Alpine Linux libreswan package to 5.3.3-r0 or later (for example, run apk update && apk upgrade libreswan, or apk add --upgrade libreswan=5.3.3-r0 and reboot or restart the pluto service so the new daemon binary is loaded), and consult the upstream advisory at https://libreswan.org/security/CVE-2026-94453/ plus the plain-text notice at https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt for any upstream release detail or additional guidance. If patching must be deferred, the effective compensating control is to reduce IKE exposure: restrict UDP 500 and UDP 4500 inbound to the specific peer IP addresses or management network that legitimately negotiate IPsec, using firewall or security-group rules - this fully removes reachability for the flaw but breaks connectivity for roaming or dynamic peers that cannot be allow-listed. A more restrictive alternative is to stop presenting the host as an IKE responder entirely (disable or stop the pluto service, or remove libreswan where it is not needed), with the trade-off that all IPsec tunnels to and from that host fail. Because the flaw is unauthenticated and network-triggered, rate limiting or fail2ban-style controls on UDP 500/4500 are only partial mitigations and can be bypassed by a single crafted packet, so they should be treated as temporary hardening rather than a substitute for upgrading to 5.3.3-r0.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Libreswan implements IPsec/IKE and its core daemon (pluto) handles Internet Key Exchange negotiation over UDP ports 500 (IKE) and 4500 (NAT-Traversal). The root cause class here is CWE-416, use-after-free: a memory region is freed while still referenced during IKE message or state processing, so the subsequent dereference corrupts memory or triggers an immediate crash of the daemon. The supplied tags (Use After Free, Memory Corruption) align exactly with that class, while the additional Information Disclosure tag is not reflected in the assessed vector, which scores confidentiality and integrity as None and only availability as High - consistent with an out-of-bounds reuse that terminates the process before any meaningful data exposure occurs. Because the CVSS vector carries PR:N and UI:N, the vulnerable code path is reached without authentication or user interaction once an attacker can send IKE packets to the listening daemon, making exposure a function of network reachability to the IKE service rather than of any credential or positional privilege. This is an Alpine Linux packaging/advisory record for the upstream Libreswan fix, so the affected artifact is the distribution's libreswan package rather than the upstream source tree alone; no CPE strings were supplied in the input data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted packets to the IKE listener (AV:N/AC:L/PR:N/UI:N); use-after-free yields a daemon crash so A:H with C:N/I:N.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
Lifecycle Timeline
1DescriptionCVE.org
Alpine Linux: libreswan fixed in 5.3.3-r0
Executive ViewAI
A denial-of-service vulnerability in the Libreswan IKE daemon on Alpine Linux can crash IPsec/VPN endpoints, disrupting remote access for employees and partners. Because the flaw is unauthenticated and network-reachable, any exposed VPN gateway is at risk until patched or firewalled. Leadership should prioritize remediation to maintain availability of critical remote connectivity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB