- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 24
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 7 days
The project commits to responding within days and to publishing a fix typically within several weeks
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://libreswan.org
Products and areas 12
- Authentication in every supported mode, covering pre-shared keys, RSA and ECDSA signatures, EdDSA, null authentication, XAUTH and the EAP paths
- Configuration parsing: ipsec.conf, ipsec.secrets, the conn syntax, includes and the addconn helper that loads them
- IKE fragmentation and reassembly, plus NAT-traversal detection and the keepalive handling that goes with it
- Individual payload parsing across both protocol versions: security association proposals, key exchange, nonce, notify, delete, vendor ID, certificate and certificate request payloads
- Opportunistic encryption and the DNS-derived policy paths, where remote data influences local policy
- The NSS binding and the key derivation, PRF and cipher handling that runs on top of it
- The pluto daemon in full, including the IKEv1 and IKEv2 state machines and everything parsed on UDP 500 and 4500 before authentication completes
- The pluto helper processes and the logging path, both of which handle attacker-influenced data on a privileged daemon
- The security page asks for reports to the project security address, optionally encrypted to the Libreswan OpenPGP key, and sets out a response commitment rather than a scope boundary. Nothing narrower than the Libreswan tree is carved out
- The whack control socket and the ipsec command-line tooling that drives a running daemon, along with the privilege boundary between them
- The X.509 path: certificate chain building and validation, name constraints, CRL fetching and OCSP checking, and the decision about whether a peer certificate authorises a connection
- XFRM and netlink policy installation into the kernel, including traffic-selector narrowing and the decision about what is encrypted and what leaves in the clear
Out of scope (6)
- Criticism of the IKE and IPsec standards themselves, as opposed to a defect in this implementation
- Distribution packaging and vendor backport patches rather than the upstream tree
- Kernel XFRM and IPsec defects, which belong to the Linux kernel rather than to Libreswan
- NSS library defects, unless Libreswan's own use of NSS is what makes them reachable
- strongSwan and other IPsec implementations, which are separate projects with their own security addresses
- Weak proposals, weak pre-shared keys or permissive connection definitions the operator chose deliberately
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report privately to the address on the policy page , optionally encrypted to the published Libreswan OpenPGP key
-
You cannot set the disclosure date. The project states plainly that a reporter cannot mandate a timeline, and it decides when the advisory goes out
-
Do not attach NDA-style conditions to the report. The project will not agree to confidentiality terms before it has received the information
-
Include the connection configuration, the IKE version and the exact packet or exchange that triggers the bug. Behaviour on this surface turns on negotiated parameters more than on build options
-
Findings in strongSwan or another IPsec implementation belong with that project, not here
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-50722 | Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a | High 8.1 | 2 Jul 2026 |
| CVE-2026-12413 | An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) c | High 7.5 | 2 Jul 2026 |
| CVE-2026-50721 | Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to | High 8.1 | 2 Jul 2026 |
| CVE-2024-3652 | The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected. | Medium 6.5 | 11 Apr 2024 |
| CVE-2023-38710 | An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash a | Medium 6.5 | 25 Aug 2023 |
| CVE-2023-38711 | An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6. | Medium 6.5 | 25 Aug 2023 |
| CVE-2023-38712 | An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart. | Medium 6.5 | 25 Aug 2023 |
| CVE-2023-30570 | pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticated IKEv1 Aggressive Mode packets. The earliest affected version is 3.28. | High 7.5 | 29 May 2023 |
| CVE-2023-2295 | A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote co | High 7.5 | 17 May 2023 |
| CVE-2023-23009 | Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS payload with an incorrect selector length. | Medium 6.5 | 21 Feb 2023 |
| CVE-2022-23094 | Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKEv1 packet because pluto/ikev1.c wrongly expects that a state object exists. This is fixed in 4.6. | High 7.5 | 15 Jan 2022 |
| CVE-2020-1763 | An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unauthenticated attacker could use this flaw to crash libreswan by sending specially-crafted IKEv1 Informational Exchange packets. The daemon respawns after the crash. | High 7.5 | 12 May 2020 |
| CVE-2019-10155 | The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the established IKE SA encryption and integrity keys, but as a receiver, the integrity check value was not verified. This issue affects versions before 3.29. | Low 3.1 | 12 Jun 2019 |
| CVE-2019-12312 | In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. An attacker can trigger a NULL pointer dereference by initiating an IKEv2 IKE_SA_INIT exchange, followed by a bogus INFORMATIONAL exchange instead of the normallly expected IKE_AUTH exchange. This affects send_v2N_spi_response_from_state() in programs/pluto/ikev2_send.c that will then trigger a NULL pointer dereference | High 7.5 | 24 May 2019 |
| CVE-2016-5391 | libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon restart). | High 7.5 | 13 Jun 2017 |
| CVE-2016-5361 | programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will | High 7.5 | 16 Jun 2016 |
| CVE-2016-3071 | Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform. | High 7.5 | 18 Apr 2016 |
| CVE-2015-3240 | The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of service (assertion failure and daemon restart) via a zero DH g^x value in a KE payload in a IKE packet. | Medium 4.3 | 9 Nov 2015 |
| CVE-2015-3204 | libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK. | Medium 5.0 | 1 Jul 2015 |
| CVE-2013-6467 | Libreswan 3.7 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. | Medium 5.0 | 26 Jan 2014 |
| CVE-2013-7294 | The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (restart) via an IKEv2 I1 notification without a KE payload. | Medium 5.0 | 16 Jan 2014 |
| CVE-2013-7283 | Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecified impact and attack vectors, involving the /var/tmp/libreswan-nss-pwd temporary file. | High 9.3 | 9 Jan 2014 |
| CVE-2013-4564 | Libreswan 3.6 allows remote attackers to cause a denial of service (crash) via a small length value and (1) no version or (2) an invalid major number in an IKE packet. | Medium 5.0 | 7 Jan 2014 |
| CVE-2013-2052 | Buffer overflow in the atodn function in libreswan 3.0 and 3.1, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2053 and CVE-2013-2054. | Medium 5.1 | 9 Jul 2013 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months Memory safety 40 % Auth bypass 28 % Denial of service 22 % Parsing/validation 10 % Latest advisories Loading the feed Overview Libreswan is the IPsec implementation that ships as the default on Red Hat Enterprise Linux, CentOS Stream and Fedora, putting it on the VPN edge of a large share of enterprise Linux estates. Its pluto daemon answers IKE on UDP 500 and 4500 before any peer has authenticated, and the machines running it are gateways that face the public internet and get patched on a change-control calendar rather than a fast one. A pre-authentication defect there is remote code execution on the device whose entire job is to be exposed. The project publishes its own advisories and pays nothing for a report, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The security page asks for reports to the project security address, optionally encrypted to the Libreswan OpenPGP key, and sets out a response commitment rather than a scope boundary. Nothing narrower than the Libreswan tree is carved out The pluto daemon in full, including the IKEv1 and IKEv2 state machines and everything parsed on UDP 500 and 4500 before authentication completes Individual payload parsing across both protocol versions: security association proposals, key exchange, nonce, notify, delete, vendor ID, certificate and certificate request payloads IKE fragmentation and reassembly, plus NAT-traversal detection and the keepalive handling that goes with it The X.509 path: certificate chain building and validation, name constraints, CRL fetching and OCSP checking, and the decision about whether a peer certificate authorises a connection Authentication in every supported mode, covering pre-shared keys, RSA and ECDSA signatures, EdDSA, null authentication, XAUTH and the EAP paths The NSS binding and the key derivation, PRF and cipher handling that runs on top of it Configuration parsing: ipsec.conf , ipsec.secrets , the conn syntax, includes and the addconn helper that loads them The whack control socket and the ipsec command-line tooling that drives a running daemon, along with the privilege boundary between them XFRM and netlink policy installation into the kernel, including traffic-selector narrowing and the decision about what is encrypted and what leaves in the clear Opportunistic encryption and the DNS-derived policy paths, where remote data influences local policy The pluto helper processes and the logging path, both of which handle attacker-influenced data on a privileged daemon Out of scope strongSwan and other IPsec implementations, which are separate projects with their own security addresses Kernel XFRM and IPsec defects, which belong to the Linux kernel rather than to Libreswan Weak proposals, weak pre-shared keys or permissive connection definitions the operator chose deliberately Distribution packaging and vendor backport patches rather than the upstream tree Criticism of the IKE and IPsec standards themselves, as opposed to a defect in this implementation NSS library defects, unless Libreswan's own use of NSS is what makes them reachable Most-valued findings Pre-authentication memory corruption in the IKEv1 or IKEv2 parsers on UDP 500 or 4500. This is the highest-value class on the project by a wide margin, because the daemon is internet-facing and runs privileged on a gateway Certificate chain or name-constraint validation errors that let a peer authenticate with a certificate it should not be able to use, which admits an outside party straight into the protected network Authentication bypass through the PSK, signature, XAUTH or EAP paths, where a peer establishes a tunnel without holding the credential the configuration requires Traffic-selector narrowing and XFRM policy confusion, where installed policy sends plaintext on a path the operator believed was encrypted, or accepts traffic that should have been dropped Fragmentation and reassembly defects, a classic source of pre-auth memory bugs in IKE implementations and reachable with no session state at all Remotely triggerable daemon crashes or state-machine deadlocks with a real algorithmic cause, on a service whose availability is the site-to-site link itself Privilege boundary failures between the whack control socket, the helper processes and the privileged daemon, which turn local access into control of the VPN policy Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately to [email protected] , optionally encrypted to the published Libreswan OpenPGP key The project commits to responding within days and to publishing a fix typically within several weeks, so expect a real process rather than silence You cannot set the disclosure date. The project states plainly that a reporter cannot mandate a timeline, and it decides when the advisory goes out Do not attach NDA-style conditions to the report. The project will not agree to confidentiality terms before it has received the information Include the connection configuration, the IKE version and the exact packet or exchange that triggers the bug. Behaviour on this surface turns on negotiated parameters more than on build options Findings in strongSwan or another IPsec implementation belong with that project, not here There is no reward of any kind. Credit in the advisory is what the project offers Disclosure Coordinated with the Libreswan security team by email and published on libreswan.org/security alongside a fixed release. The published expectation is a response in days and a fix in weeks, with the project holding the disclosure decision rather than the reporter. Enterprise distributions backport Libreswan fixes on their own schedule, so hold the detail until the project's advisory and the corresponding release are both out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability