An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.

The version of Libreswan installed on the remote host is between 4.6 and 5.3.1 (exclusive). It is, therefore, affected by a denial of service vulnerability. An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.

Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-12413 advisory.

  - An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued     exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore     unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-     one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to     abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not     set fragmentation=no are vulnerable. IKEv1 is not affected. (CVE-2026-12413)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued     exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore     unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-     one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to     abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not     set fragmentation=no are vulnerable. IKEv1 is not affected. (CVE-2026-12413)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327416	Libreswan 4.6 < 5.3.1 DoS	Nessus	Misc.	high
326878	Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-12413)	Nessus	Azure Linux Local Security Checks	high
324996	Linux Distros Unpatched Vulnerability : CVE-2026-12413	Nessus	Misc.	high

Detections

Analytics

CVE-2026-12413

high

Tenable Plugins

high

high

high