Out-of-bounds read in libreswan
Priority LOW 39CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash.
Why it matters now
EPSS 0.03575 89th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Libreswan Project | libreswan | from versions 3.27 till 3.31 | — | No fix listed | CNA |
- libreswan VendorThe Libreswan Project Affected from versions 3.27 till 3.31 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libreswan:libreswan:*:*:*:*:*:*:*:* | 3.27 – 3.31 | Vulnerable | The Libreswan Project |
| cpe:2.3:a:libreswan:libreswan:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | The Libreswan Project |
- cpe:2.3:a:libreswan:libreswan:*:*:*:*:*:*:*:* Versions 3.27 – 3.31 Vulnerable ·The Libreswan Project
- cpe:2.3:a:libreswan:libreswan:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·The Libreswan Project
Remediation
Red Hat 3 advisories
- RHSA-2020:2070 Released 2020-05-12 · Red Hat rating Importantlibreswan security update
- Red Hat Enterprise Linux AppStream (v. 8) libreswan-3.29-7.el8_2
- RHSA-2020:2071 Released 2020-05-12 · Red Hat rating Importantlibreswan security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.1) libreswan-3.29-7.el8_1
- RHSA-2020:2069 Released 2020-05-12 · Red Hat rating Importantlibreswan security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.0) libreswan-3.27-10.el8_0
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:2070 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.0) | Fixed | RHSA-2020:2069 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.1) | Fixed | RHSA-2020:2071 |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1763
- 2026-10-03 Alias added: GHSA-wx69-vm3h-3cgv
References
Patch 2
More The Libreswan Project Libreswan vulnerabilities
- TI-2023-09114 Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and… CVSS 3.1MEDIUM 6.5
- TI-2013-05949 Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora… CVSS 2.0HIGH 9.3
- TI-2023-02152 Uncontrolled resource consumption in libreswan CVSS 3.1HIGH 7.5
- TI-2026-37395 IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload CVSS 3.1HIGH 8.1
- TI-2026-37394 IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload CVSS 3.1HIGH 8.1
- TI-2023-14401 pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and… CVSS 3.1HIGH 7.5
Sources
- CVE-2020-1763 · CVE Program
- CVE-2020-1763 · NVD
- FIRST EPSS
- GHSA-wx69-vm3h-3cgv · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1763 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences