The Libreswan Project libreswan
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-77207 | 4.7 – 5.3.2 ; 5.4 | Null Pointer Dereference in PKCS#7 bundle with no certificates | HIGH 7.5 | 0.5 % | ||
| CVE-2026-77206 | 4.7 – 5.3.2 ; 5.4 | IKEv2 pre-authentication Null Pointer Dereference in EAP code | HIGH 7.5 | 0.7 % | ||
| CVE-2026-77205 | 5.3 – 5.3.2 | Denial of Service via sending bogus X.509 certificates | LOW 3.7 | 0.2 % | ||
| CVE-2026-94453 | 4.0 – 5.3.2 ; 5.4 | IKEv2 Use-After-Free bug when using IKE-over-TCP | HIGH 7.5 | 0.5 % | ||
| CVE-2026-14957 | 3.0 – 5.3.1 | FIPS mode assertion failure via malicious CERT payload | HIGH 7.5 | 0.5 % | ||
| CVE-2026-50721 | ≤ 5.3 | IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload | HIGH 7.5 | 0.4 % | ||
| CVE-2026-50722 | ≤ 5.3 | IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload | HIGH 7.5 | 0.3 % | ||
| CVE-2026-12413 | 4.6 – 5.3 | IKEv2 Denial of Service via malformed fragmentation | HIGH 7.5 | 0.6 % | ||
| CVE-2020-1763 | from versions 3.27 till 3.31 | An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker | HIGH 7.5 | 3.6 % | ||
| CVE-2019-10155 | 3.29 | The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity | LOW 3.1 | 0.5 % |