Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Libreswan bug bounty programs

libreswan.org Updated

Libreswan runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Libreswan runs.

  • Libreswan

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial
    First response
    7 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://libreswan.org

    Web

  • Authentication in every supported mode, covering pre-shared keys, RSA and ECDSA signatures, EdDSA, null authentication, XAUTH and the EAP paths

    Products and areas

  • Configuration parsing: ipsec.conf, ipsec.secrets, the conn syntax, includes and the addconn helper that loads them

    Products and areas

  • IKE fragmentation and reassembly, plus NAT-traversal detection and the keepalive handling that goes with it

    Products and areas

  • Individual payload parsing across both protocol versions: security association proposals, key exchange, nonce, notify, delete, vendor ID, certificate and certificate request payloads

    Products and areas

  • Opportunistic encryption and the DNS-derived policy paths, where remote data influences local policy

    Products and areas

  • The NSS binding and the key derivation, PRF and cipher handling that runs on top of it

    Products and areas

  • The pluto daemon in full, including the IKEv1 and IKEv2 state machines and everything parsed on UDP 500 and 4500 before authentication completes

    Products and areas

  • The pluto helper processes and the logging path, both of which handle attacker-influenced data on a privileged daemon

    Products and areas

  • The security page asks for reports to the project security address, optionally encrypted to the Libreswan OpenPGP key, and sets out a response commitment rather than a scope boundary. Nothing narrower than the Libreswan tree is carved out

    Products and areas

  • The whack control socket and the ipsec command-line tooling that drives a running daemon, along with the privilege boundary between them

    Products and areas

  • The X.509 path: certificate chain building and validation, name constraints, CRL fetching and OCSP checking, and the decision about whether a peer certificate authorises a connection

    Products and areas

  • XFRM and netlink policy installation into the kernel, including traffic-selector narrowing and the decision about what is encrypted and what leaves in the clear

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Criticism of the IKE and IPsec standards themselves, as opposed to a defect in this implementation

  • Distribution packaging and vendor backport patches rather than the upstream tree

  • Kernel XFRM and IPsec defects, which belong to the Linux kernel rather than to Libreswan

  • NSS library defects, unless Libreswan's own use of NSS is what makes them reachable

  • strongSwan and other IPsec implementations, which are separate projects with their own security addresses

  • Weak proposals, weak pre-shared keys or permissive connection definitions the operator chose deliberately

Recent changes

Reward and scope changes across every Libreswan program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Libreswan products, from the NVD.

Search NVD
  • CVE-2026-50722 High

    Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a

  • CVE-2026-12413 High

    An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) c

  • CVE-2026-50721 High

    Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to

  • CVE-2024-3652 Medium

    The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.

  • CVE-2023-38710 Medium

    An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash a

  • CVE-2023-38711 Medium

    An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6.

  • CVE-2023-38712 Medium

    An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart.

  • CVE-2023-30570 High

    pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28.

About this page

This page gathers every public program listed under libreswan.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.