Hu Xinyao

**Name of the Vulnerable Software and Affected Versions** Libreswan (affected versions not specified) **Description** An invalidly formatted IKEv2 fragment can cause the pluto daemon to crash and restart, leading to a denial of service. The issue occurs within the `reassemble v2 incoming fragments()` function, which ignores unknown outer payloads but stores them in a fixed-size array `msg digest.digest[PAYLIMIT]`. An off-by-one error in the assertion `PASSERT(logger, md->digest roof < elemsof(md->digest))` triggers the daemon to abort. This affects any configuration allowing IKEv2 connections where `fragmentation=no` is not set. Remote code execution is not possible. **Recommendations** As a temporary mitigation, set `fragmentation=no` in the configuration to disable IKEv2 fragmentation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.