# CVE-2026-94453: Libreswan pluto use-after-free in IKE over TCP

Source: https://junglewise.ai/threats/cve-2026-94453-libreswan-s-pluto-daemon-has-a-use-after-free-vulnerability-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-94453 · Severity: high · CVSS 7.5 · Published 2026-10-13

Libreswan is an open-source IPsec VPN implementation widely used to secure network communications. A use-after-free vulnerability in its pluto daemon can be triggered when an IKE over TCP connection closes and a subsequent packet arrives, causing the daemon to crash and restart. An unauthenticated attacker on the network can exploit this remotively to cause repeated denial of service, and potential remote code execution is possible.

Technologies: [Libreswan](https://junglewise.ai/threats/technologies/libreswan-libreswan). Vendors: [Libreswan](https://junglewise.ai/threats/vendors/libreswan).

## Quick answers

**Is CVE-2026-94453 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94453 being exploited in the wild.

**How severe is CVE-2026-94453?** High severity, with a CVSS score of 7.5, published 13 October 2026.

**Which products and versions are affected?** Libreswan <5.3.

**Is there a fix for CVE-2026-94453?** Yes: fixed in Libreswan 5.3, 5.4. Until then: Disable IKE over TCP if not required by setting listen-tcp=no in the Libreswan configuration, or restrict network access to the pluto daemon from untrusted peers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94453 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-94453?** Check whether you run Libreswan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Libreswan 5.3, 5.4

Disable IKE over TCP if not required by setting listen-tcp=no in the Libreswan configuration, or restrict network access to the pluto daemon from untrusted peers.

## Technical details

A use-after-free vulnerability exists in pluto's handling of IKE over TCP connections: when a client closes the connection, IKE state is retained with an invalid pointer to iface_endpoint in ike_sa.sa->st_iface_endpoint; a subsequent retransmit or malicious packet for the same tuple dereferences this pointer, crashing the daemon. The vulnerability can be triggered before peer authentication and only affects configurations with listen-tcp=yes enabled.

## Affected products

- Libreswan Libreswan <5.3

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/libreswan/libreswan](https://github.com/libreswan/libreswan)
- [https://libreswan.org/security/CVE-2026-94453/](https://libreswan.org/security/CVE-2026-94453/)

## Related threats

- [Libreswan null pointer dereference in PKCS#7 handling](https://junglewise.ai/threats/cve-2026-77207-libreswan-has-a-null-pointer-dereference-bug-in-the-pkcs-7)
- [Libreswan IKEv2 null pointer dereference in EAP handling](https://junglewise.ai/threats/cve-2026-77206-libreswan-s-ikev2-state-machine-has-a-null-pointer-dereference)