CVE-2024-3652 IKEv1 default AH/ESP responder can cause libreswan to abort and restart

Medium 6.5 Published 11 Apr 2024 Updated 27 Feb 2026

A remote attacker can cause a denial of service by triggering an assertion failure in Libreswan's IKEv1 responder when AES-GMAC is requested without an explicit esp configuration.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-3652?

CVE-2024-3652 is a medium-severity denial of service vulnerability in The Libreswan Project (www.libreswan.org) libreswan, published on 11 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.

Weakness: CWE-404

Which versions are affected by CVE-2024-3652?

It affects 1 product.

Linux distribution packages (28)

`libreswan` AlmaLinux:8	All versions	`4.12-2.el8_10.4`
`libreswan` AlmaLinux:9	All versions	`4.12-2.el9_4.1`
`libreswan` Red Hat:enterprise_linux:8::appstream	All versions	`0:4.12-2.el8_10.4`
`libreswan-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:4.12-2.el8_10.4`
`libreswan-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:4.12-2.el8_10.4`
`libreswan` Red Hat:enterprise_linux:9::appstream	All versions	`0:4.12-2.el9_4.1`
`libreswan-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:4.12-2.el9_4.1`
`libreswan-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:4.12-2.el9_4.1`
`libreswan` Red Hat:rhel_aus:8.6::appstream	All versions	`0:4.5-1.el8_6.3`
`libreswan-debuginfo` Red Hat:rhel_aus:8.6::appstream	All versions	`0:4.5-1.el8_6.3`
`libreswan-debugsource` Red Hat:rhel_aus:8.6::appstream	All versions	`0:4.5-1.el8_6.3`
`libreswan` Red Hat:rhel_e4s:8.6::appstream	All versions	`0:4.5-1.el8_6.3`
`libreswan-debuginfo` Red Hat:rhel_e4s:8.6::appstream	All versions	`0:4.5-1.el8_6.3`
`libreswan-debugsource` Red Hat:rhel_e4s:8.6::appstream	All versions	`0:4.5-1.el8_6.3`
`libreswan` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:4.6-3.el9_0.2`
`libreswan-debuginfo` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:4.6-3.el9_0.2`
`libreswan-debugsource` Red Hat:rhel_e4s:9.0::appstream	All versions	`0:4.6-3.el9_0.2`
`libreswan` Red Hat:rhel_eus:8.8::appstream	All versions	`0:4.9-3.el8_8.2`
`libreswan-debuginfo` Red Hat:rhel_eus:8.8::appstream	All versions	`0:4.9-3.el8_8.2`
`libreswan-debugsource` Red Hat:rhel_eus:8.8::appstream	All versions	`0:4.9-3.el8_8.2`
`libreswan` Red Hat:rhel_eus:9.2::appstream	All versions	`0:4.9-5.el9_2.2`
`libreswan-debuginfo` Red Hat:rhel_eus:9.2::appstream	All versions	`0:4.9-5.el9_2.2`
`libreswan-debugsource` Red Hat:rhel_eus:9.2::appstream	All versions	`0:4.9-5.el9_2.2`
`libreswan` Red Hat:rhel_tus:8.6::appstream	All versions	`0:4.5-1.el8_6.3`
`libreswan-debuginfo` Red Hat:rhel_tus:8.6::appstream	All versions	`0:4.5-1.el8_6.3`
`libreswan-debugsource` Red Hat:rhel_tus:8.6::appstream	All versions	`0:4.5-1.el8_6.3`
`libreswan` Rocky Linux:8	All versions	`0:4.12-2.el8_10.4`
`libreswan` Rocky Linux:9	All versions	`0:4.12-2.el9_4.1`

Products include Libreswan Libreswan.

How do I fix CVE-2024-3652?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-3652 being exploited?

There is no known exploitation of CVE-2024-3652 in the wild and no public exploit code.

Sources

Also known as ALSA-2024:4050, ALSA-2024:4376, AZL-39919, AZL-39927, CLSA-2025-1752749664, DEBIAN-CVE-2024-3652 and 12 more.