What is the CVSS score of EUVD-2026-41439?

EUVD-2026-41439 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of Libreswan are affected by EUVD-2026-41439?

Libreswan IPsec VPN deployments are exposed to repeated remote denial-of-service attacks that crash the gateway without requiring authentication or patches.. A patch is available.

How to fix or mitigate EUVD-2026-41439?

Within 24 hours: Inventory all Libreswan installations and verify fragmentation settings in IKEv2 configurations. Within 7 days: Implement interim protections by setting fragmentation=no in IKEv2 settings and deploying network-level rate limiting on IKE ports (UDP 500/4500). Within 30 days: Subscribe to Libreswan project advisories and establish patch testing procedures in preparation for vendor release.

Libreswan EUVD-2026-41439

| CVE-2026-12413 HIGH

Off-by-one Error (CWE-193)

2026-07-02 libreswan

GHSA-vj68-68x2-jwjq

Denial Of Service RCE Libreswan Red Hat Suse

7.5

CVSS 3.1 · Vendor: libreswan

Severity by source

Vendor (libreswan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated single crafted packet against default IKEv2 (AV:N/AC:L/PR:N/UI:N); impact is availability-only crash with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (libreswan).

CVSS VectorVendor: libreswan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 22:15 vuln.today

DescriptionCVE.org

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.

AnalysisAI

Denial of service in the Libreswan IPsec VPN's pluto daemon allows remote unauthenticated attackers to crash and repeatedly restart the daemon by sending an invalidly formatted IKEv2 fragment. The off-by-one flaw affects any deployment permitting IKEv2 connections that do not explicitly set fragmentation=no, with no authentication or user interaction required; repeated exploitation sustains the outage. No public exploit identified at time of analysis, and no remote code execution is possible despite the mislabeled 'RCE' tag.

Technical ContextAI

Libreswan is an open-source IKE/IPsec implementation (a fork of Openswan/FreeS/WAN) whose user-space pluto daemon negotiates IKEv2 security associations. During IKEv2 fragment reassembly, reassemble_v2_incoming_fragments() ignores unknown outer payloads but still records each into the fixed-size msg_digest.digest[PAYLIMIT] array. Because the code stores entries it should skip, the digest_roof index can reach the array bound, and the guard PASSERT(logger, md->digest_roof < elemsof(md->digest)) fires and aborts the process. This is a textbook CWE-193 Off-by-one Error: an inclusive/exclusive boundary mismatch that turns a defensive assertion into a crash primitive. The affected component is identified by CPE cpe:2.3:a:the_libreswan_project:libreswan (all versions per the wildcard CPE); only the IKEv2 code path is affected, IKEv1 is not.

RemediationAI

No exact fixed version is provided in the input data, so no vendor-released patch version can be independently confirmed here - consult the Libreswan advisory at https://libreswan.org/security/CVE-2026-12413/ (full text https://libreswan.org/security/CVE-2026-12413/CVE-2026-12413.txt) for the patched release and upgrade to it as the primary fix. As an immediate compensating control the vendor guidance is implied directly by the vulnerable condition: set fragmentation=no on IKEv2 connection definitions, since only configurations that permit IKE fragmentation are affected; the trade-off is that disabling IKE fragmentation can break IKEv2 negotiation across networks that fragment large UDP packets or have restrictive MTUs, potentially causing connection failures for legitimate peers behind such paths. Additionally restrict IKE/UDP 500 and 4500 exposure to known peer IP ranges via firewall rules to limit who can send crafted fragments, and monitor pluto for repeated restarts as a detection signal; where feasible, prefer IKEv1 is not a recommended substitute but IKEv1-only deployments are noted as unaffected.