Use-After-Free Vulnerability in Libreswan's Pluto Daemon Affects Network Security

CVE-2026-94453

What is CVE-2026-94453?

The Libreswan pluto daemon is susceptible to a use-after-free vulnerability that triggers when a client using IKE over TCP unexpectedly closes the connection. If another packet is received for the same tuple—whether a retransmission or a malicious packet—the daemon retains IKE state information in memory despite the client disconnection. This invalid pointer reference results in a crash and restart of the daemon, potentially leading to denial of service. The issue can be exploited prior to the authentication of the remote peer. Although IKE over TCP is not enabled by default, systems with the configuration option 'listen-tcp=yes' are at risk, with the possibility of enabling remote code execution under certain circumstances.

References