CVE-2026-94453

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service.

Red Hat Product Security has rated this vulnerability as having an Important security impact. A remote, unauthenticated attacker may exploit a use-after-free in Libreswan's IKE-over-TCP handling before peer authentication to cause the IKE daemon to crash and restart. Repeated exploitation can result in denial of service.

The vulnerability affects only configurations that explicitly enable IKE-over-TCP using listen-tcp=yes; this option is not enabled by default. Consequently, exposure is limited to systems configured to accept IKE-over-TCP connections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If IKE-over-TCP is not required, administrators can temporarily mitigate this vulnerability by setting listen-tcp=no in the Libreswan configuration. This disables the vulnerable IKE-over-TCP functionality.

If IKE-over-TCP is required, administrators should restrict access to the listener to trusted peers where practical and apply the appropriate security update once available.