CVE-2026-12413 IKEv2 Denial of Service via malformed fragmentation

High 7.5 Published 2 Jul 2026 Updated 7 Jul 2026

Remote attackers can crash the Libreswan pluto daemon by sending malformed IKEv2 fragments, causing a denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-12413?

CVE-2026-12413 is a high-severity denial of service vulnerability in The Libreswan Project libreswan, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.

Weakness: CWE-617, CWE-193

Which versions are affected by CVE-2026-12413?

It affects 1 product.

Products include Libreswan Libreswan.

How do I fix CVE-2026-12413?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-12413 being exploited?

There is no known exploitation of CVE-2026-12413 in the wild and no public exploit code.

Sources

Also known as AZL-91779, CLSA-2026-1784019530, CLSA-2026-1784075638, DEBIAN-CVE-2026-12413, GHSA-vj68-68x2-jwjq, UBUNTU-CVE-2026-12413.