An invalidly formatted IKEv2 fragment sent to the Libreswan pluto daemon triggers an off‑by‑one boundary‑check error (CWE‑193) and a sequence‑point issue (CWE‑617); the reassemble_v2_incoming_fragments() function stores the payload in a fixed size array, causes an assertion failure, aborts the daemon and forces a restart. No code execution is possible; the impact is limited to service interruption. The flaw affects only IKEv2; IKEv1 is not impacted.

All Libreswan IKEv2 connections that enable packet fragmentation on versions earlier than 5.3.1, including the 4.15 branch. Any configuration that allows IKEv2 traffic without setting fragmentation=no is vulnerable. Disabling fragmentation in IKEv2 settings removes the risk.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score of < 1 % shows a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most probable attack vector is a network attacker who can inject malformed fragmented IKEv2 packets; repeated exploitation would cause the pluto daemon to crash repeatedly, resulting in denied service for legitimate VPN users.