Is CVE-2026-12413 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12413 being exploited in the wild.

How severe is CVE-2026-12413?

High severity, with a CVSS score of 7.5, published 2 July 2026.

Which products and versions are affected?

The Libreswan Project Libreswan 4.6 to 5.3.

Is there a fix for CVE-2026-12413?

A patch was published on 2026-06-24: Public announcement and release of version 5.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12413 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12413?

Check whether you run The Libreswan Project Libreswan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12413: Libreswan pluto daemon denial of service in IKEv2 fragmentation

CVE-2026-12413 · Severity: high · CVSS 7.5 · Published 2026-07-02

Libreswan is a widely used tool for creating secure VPN connections. A flaw in how it handles specific types of encrypted network traffic (IKEv2 fragments) allows a remote attacker to crash the service. If an attacker repeatedly sends these malformed messages, they can cause a sustained denial of service, preventing users from connecting to the VPN.

Technologies: The Libreswan Project Libreswan. Vendors: The Libreswan Project.

Quick answers

Is CVE-2026-12413 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12413 being exploited in the wild.
How severe is CVE-2026-12413?: High severity, with a CVSS score of 7.5, published 2 July 2026.
Which products and versions are affected?: The Libreswan Project Libreswan 4.6 to 5.3.
Is there a fix for CVE-2026-12413?: A patch was published on 2026-06-24: Public announcement and release of version 5.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12413 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12413?: Check whether you run The Libreswan Project Libreswan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Libreswan pluto daemon within the reassemble_v2_incoming_fragments() function. The function fails to properly validate the number of unknown outer payloads before storing them in the fixed-size msg_digest.digest[PAYLIMIT] array. An off-by-one error in a PASSERT check (using < instead of <=) causes the daemon to abort and restart when processing specifically malformed IKEv2 fragments. This is a remote, unauthenticated denial-of-service vulnerability; however, remote code execution is not possible. The issue is resolved in version 5.3.1.

Affected products

The Libreswan Project libreswan 4.6 to 5.3

Timeline

2026-06-16: disclosed: Libreswan notified of the issue
2026-06-24: patched: Public announcement and release of version 5.3.1
2026-07-02: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.