CVE-2011-3380: Xelerance Openswan

Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days.

Openswan 2.6.29 through 2.6.35 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto IKE daemon crash) via an ISAKMP message with an invalid KEY_LENGTH attribute, which is not properly handled by the error handling function.

Affected products

• Xelerance Openswan: version 2.6.29 only; version 2.6.30 only; version 2.6.31 only; version 2.6.32 only; version 2.6.33 only; version 2.6.34 only; …

Published 2011-11-17. Last modified 2026-06-16.