Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A vulnerability in libreswan, an IPsec and IKE implementation for Linux, allows the IKEv1 default AH/ESP responder to crash and restart. This issue is tracked as CVE-2024-3652 and affects Red Hat Enterprise Linux 8 and related variants. The vulnerability has been rated with moderate security impact by Red Hat. A security update has been released to address this issue.

CVE-2024-3652 is a vulnerability in libreswan's IKEv1 default AH/ESP responder that can cause the responder to crash and restart. Libreswan provides IPsec and IKE services for Linux, enabling secure VPN tunnels. The crash could disrupt IPsec connections but does not indicate further exploitation details. Red Hat has issued security advisories RHSA-2024:4200 and RHSA-2024:4376 providing updated libreswan packages to fix this issue in Red Hat Enterprise Linux 8 and its Extended Update Support and Extended Life Cycle versions.

Detailed information about Red Hat Security Advisory: libreswan security update affecting Red Hat Product Security Red Hat. Get real-time updates, technical det

Red Hat Security Advisory: libreswan security update - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/errata/RHSA-2024:4200

https://access.redhat.com/security/updates/classification/#moderate

2274448

Canonical URL

https://access.redhat.com/errata/RHSA-2024:4376

Red Hat Security Advisory: libreswan security update

libreswan

The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.

CVE-2024-3652 is a medium-severity vulnerability identified in Libreswan version 3.22, specifically affecting the handling of IKEv1 VPN connections. Libreswan is an open-source implementation of IPsec used widely for secure VPN tunnels. The vulnerability occurs when IKEv1 connections are established without explicitly specifying the esp= configuration line. In such cases, if the peer requests the AES-GMAC algorithm for authentication, Libreswan's default proposal handler triggers an assertion failure. This failure causes the Libreswan process to abort unexpectedly and restart, disrupting VPN service availability. The root cause is linked to improper handling of default AH/ESP configurations in the IKEv1 negotiation phase. Notably, IKEv2 connections remain unaffected by this issue. The vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release), indicating that the software does not gracefully handle unexpected negotiation parameters, leading to a crash. The CVSS v3.1 base score is 6.5, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and impact limited to availability. No patches or fixes have been publicly released at the time of disclosure, and no known exploits have been reported in the wild. This vulnerability primarily threatens the stability and reliability of VPN services relying on Libreswan IKEv1 configurations, potentially causing denial of service through repeated process restarts.

Detailed information about CVE-2024-3652: IKEv1 with default AH/ESP configuration can cause libreswan to abort and restart in The Libreswan Project (www.libresw

CVE-2024-3652: IKEv1 with default AH/ESP configuration can cause libreswan to abort and restart in The Libreswan Project (www.libreswan.org) libreswan - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-3652: IKEv1 with default AH/ESP configuration can cause libreswan to abort and restart in The Libreswan Project (www.libreswan.org) libreswan


Red Hat Security Advisory: libreswan security updateCVE-2024-3652 0 A vulnerability in libreswan, an IPsec and IKE implementation for Linux, allows the IKEv1 default AH/ESP responder to crash and restart. This issue is tracked as CVE-2024-3652 and affects Red Hat Enterprise Linux 8 and related variants. The vulnerability has been rated with moderate security impact by Red Hat. A security update has been released to address this issue. MediumVulnerability#gcve #csaf #cve-2024-3652 Join the discussion	GCVE Database	07/08/2024, 14:36:14 UTC Added: 08/26/2026, 15:02:06 UTC
CVE-2024-3652: IKEv1 with default AH/ESP configuration can cause libreswan to abort and restart in The Libreswan Project (www.libreswan.org) libreswanCVE-2024-3652 0 The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected. MediumVulnerabilityUnited StatesGermanyFrance+11#cve #cve-2024-3652 Join the discussion	CVE Database V5	04/11/2024, 01:32:13 UTC Added: 02/27/2026, 15:26:30 UTC

Threats Tagged 'cve-2024-3652'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2024-3652'

Lead Pen Test Professional