# CVE-2026-12413

## Summary

- **CVE ID:** CVE-2026-12413
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** CWE-193, CWE-617
- **Published:** Jul 2, 2026
- **Last Modified:** Jul 8, 2026

## Description

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.

## Affected Products

- The Libreswan Project — libreswan (4.6)
- The Libreswan Project — libreswan (5.3.1)

## References

- [CNA](https://libreswan.org/security/CVE-2026-12413/CVE-2026-12413.txt)
- [CNA](https://libreswan.org/security/CVE-2026-12413/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.60%
- **EPSS Percentile:** 46.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._