Libreswan
9 CVEs tracked since 2013. Since Jul 2013, none of them reached CISA KEV.
Libreswan CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2013-07 | 1 | 0 |
| 2013-08 | null or fewer | |
| 2013-09 | null or fewer | |
| 2013-10 | null or fewer | |
| 2013-11 | null or fewer | |
| 2013-12 | null or fewer | |
| 2014-01 | 4 | 0 |
| 2014-02 | null or fewer | |
| 2014-03 | null or fewer | |
| 2014-04 | null or fewer | |
| 2014-05 | null or fewer | |
| 2014-06 | null or fewer | |
| 2014-07 | null or fewer | |
| 2014-08 | null or fewer | |
| 2014-09 | null or fewer | |
| 2014-10 | null or fewer | |
| 2014-11 | null or fewer | |
| 2014-12 | null or fewer | |
| 2015-01 | null or fewer | |
| 2015-02 | null or fewer | |
| 2015-03 | null or fewer | |
| 2015-04 | null or fewer | |
| 2015-05 | null or fewer | |
| 2015-06 | null or fewer | |
| 2015-07 | 1 | 0 |
| 2015-08 | null or fewer | |
| 2015-09 | null or fewer | |
| 2015-10 | null or fewer | |
| 2015-11 | 1 | 0 |
| 2015-12 | null or fewer | |
| 2016-01 | null or fewer | |
| 2016-02 | null or fewer | |
| 2016-03 | null or fewer | |
| 2016-04 | 1 | 0 |
| 2016-05 | null or fewer | |
| 2016-06 | 1 | 0 |
Products
The products that kept showing up in Libreswan's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Libreswan.
- CVE-2026-50721IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload8.1
- CVE-2026-50722IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload8.1
- CVE-2026-12413IKEv2 Denial of Service via malformed fragmentation7.5
- CVE-2024-3652IKEv1 default AH/ESP responder can cause libreswan to abort and restart6.5
- CVE-2023-38712An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISA...6.5
- CVE-2023-38711An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference ...6.5
- CVE-2023-38710An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify pa...6.5
- CVE-2023-30570pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.7.5
- CVE-2023-2295A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is ...7.5
- CVE-2023-23009Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length.6.5
- CVE-2022-23094Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a st...7.5
- CVE-2020-1763An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specia...7.5
- CVE-2019-10155The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and int...3.1
- CVE-2019-12312In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus IN...7.5
- CVE-2016-5391libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart).7.5
The record
- Peak rank
- #35 in Jan 2014
- Busiest month shown
- Jan 2014, 4 CVEs
- Months with a KEV entry
- 0 since Jul 2013
- Monthly snapshots
- 6 since 2013