CVE-2023-38710

6.5 mediumEPSS 0.8%

Medium (6.5) in libreswan libreswan. EPSS 0.8% chance of exploitation in the next 30 days.

An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
Published: 2023-08-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

libreswan:libreswan

References

https://github.com/libreswan/libreswan/tags
https://libreswan.org/security/CVE-2023-38710/
https://github.com/libreswan/libreswan/tags
https://libreswan.org/security/CVE-2023-38710/

Check your stack JSON