Back to CVE Browser

CVE-2016-5361

HIGH

7.5

CVSS Severity Score

EPSS Score0.1710%

EPSS Percentile9.53th

PublishedJun 16, 2016

Last ModifiedMay 6, 2026

Vulnerability Description

programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each.

Affected Platforms (CPE)

📦

Libreswan

Libreswan

<= 3.16

References & Advisories

🔗 http://rhn.redhat.com/errata/RHSA-2016-2603.html

🔗 http://www.openwall.com/lists/oss-security/2016/06/10/4

🔗 https://github.com/libreswan/libreswan/commit/152d6d95632d8b9477c170f1de99bcd86d7fb1d6

🔗 https://lists.libreswan.org/pipermail/swan-dev/2016-March/001394.html

🔗 http://rhn.redhat.com/errata/RHSA-2016-2603.html

🔗 http://www.openwall.com/lists/oss-security/2016/06/10/4

🔗 https://github.com/libreswan/libreswan/commit/152d6d95632d8b9477c170f1de99bcd86d7fb1d6

🔗 https://lists.libreswan.org/pipermail/swan-dev/2016-March/001394.html

Related Vulnerabilities

CVE-2013-72839.3

Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecifie...

CVE-2020-17637.5

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticate...

CVE-2019-123127.5

In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference ...

CVE-2016-30717.5

Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.