An issue was discovered in Libreswan before 4.12.

published 2023-08-25 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-42485

cvss: 6.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits: 0; none known

An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20.

Patch / fix

fixed in 1 distros 6

libreswan libreswan 4.12

debian red hat almalinux rocky linux alpine azure linux

libreswan Debian 13 4.12-1

debian advisories DEBIAN-CVE-2023-38710

libreswan openshift 4.17, openshift 4.16, openshift 4.15 +1 more 4.6-3.el9_0.3
libreswan RHEL 8 4.12-2.el8
libreswan RHEL 9 4.12-1.el9
libreswan RHEL 9.2 EUS 4.9-5.el9_2.4

red hat advisories RHSA-2025:0309 RHBA-2024:11565 RHBA-2024:11505 RHBA-2024:11525 RHSA-2024:10594 RHSA-2023:7052

libreswan AlmaLinux 8 4.12-2.el8
libreswan AlmaLinux 9 4.12-1.el9

almalinux advisories ALSA-2023:7052 ALSA-2023:6549

libreswan Rocky Linux 8 4.12-2.el8_10.3

rocky linux advisories RLSA-2023:7052

libreswan Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 4.12-r0

alpine advisories ALPINE-CVE-2023-38710

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

libreswan CBL-Mariner 2.0 4.7-5
libreswan Azure Linux 3.0 4.7-6

azure linux advisories AZL-28064 AZL-34935

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-38710 updated 2026-11-07 cvss 6.5

libreswan: Invalid IKEv2 REKEY proposal causes restart

Red Hat Enterprise Linux 7 libreswan
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) libreswan 4.12-2.el8
fixed: vendor fix RHSA-2023:7052
Red Hat Enterprise Linux AppStream (v. 9) libreswan 4.12-1.el9
fixed: vendor fix RHSA-2023:6549
Red Hat Enterprise Linux AppStream E4S (v.9.0) libreswan 4.6-3.el9_0.3
fixed: vendor fix RHSA-2024:10594
Red Hat Enterprise Linux AppStream EUS (v.9.2) libreswan 4.9-5.el9_2.4
fixed: vendor fix RHSA-2025:0309
Red Hat OpenShift Container Platform 4.15 libreswan 4.6-3.el9_0.3
fixed: vendor fix RHBA-2024:11565
Red Hat OpenShift Container Platform 4.16 libreswan 4.6-3.el9_0.3
fixed: vendor fix RHBA-2024:11505
Red Hat OpenShift Container Platform 4.17 libreswan 4.6-3.el9_0.3
fixed: vendor fix RHBA-2024:11525

show 1 more

Red Hat Enterprise Linux 6 libreswan Red Hat OpenShift Container Platform 4.17 openshift 4.17.0-202412172334.p0.gf868289.assembly.stream.el8, openshift 4.17.0-202412172334.p0.gf868289.assembly.stream.el9, openshift-kubelet 4.17.0-202412172334.p0.gf868289.assembly.stream.el8, openshift-kubelet 4.17.0-202412172334.p0.gf868289.assembly.stream.el9, openshift-hyperkube 4.17.0-202412172334.p0.gf868289.assembly.stream.el8, openshift-hyperkube 4.17.0-202412172334.p0.gf868289.assembly.stream.el9, +6 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2023-12-18)

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

github.com /libreswan/libreswan/tags
third-party-advisory
libreswan.org /security/CVE-2023-38710/
third-party-advisory

Sources

CVE List CVE-2023-38710
NVD CVE-2023-38710

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary