Back oneuptime.com

IPsec Encapsulating Security Payload, or xfrm-ESP, path

oneuptime.com • May 11, 2026

The Encapsulating Security Payload (ESP, Header = 50) is the workhorse of IPsec security for IPv6. It can provide confidentiality (encryption), data origin authentication, connectionless integrity, anti-replay protection, and limited traffic flow confidentiality, depending on the SA and algorithms in use. ESP is more widely used than AH because it can provide both encryption and integrity in one protocol, and it is compatible with NAT traversal (unlike AH).

Unlike AH, ESP is compatible with NAT using NAT-T (UDP port 4500 encapsulation):

ESP is the standard choice for IPv6 IPsec deployments, typically providing encryption, integrity, and anti-replay protection in transport or tunnel mode. Combined mode ciphers like AES-GCM provide both encryption and authentication efficiently in a single pass. ESP's compatibility with NAT traversal makes it practical in mixed environments, unlike AH which breaks when source or destination addresses are translated. For most VPN and secure communication needs, ESP with AES-GCM is a recommended modern configuration.

@nawazdhandala • Mar 20, 2026 •

All our blog posts are open source. Found a typo, want to add more detail, or have a better explanation? Anyone can contribute and make this post better for everyone.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Linux Vulnerability 'Copy Fail' Grants Root Access Across Major Distros A newly disclosed vulnerability in the Linux kernel, tracked as CVE-2026-31431 and named 'Copy Fail', allows unprivileged local users to gain root access on virtually all major Linux distributions released since 2017. The exploit, which is a 732-byte Python script, modifies the page cache of any readable file without altering the on-disk version, making it stealthy and difficult to detect. Discovered by Theori researcher Taeyang Lee using AI-assisted tools, the flaw stems from a logic error in the kernel's cryptographic subsystem, specifically within the algif_aead module. Patches were made available on April 1, 2026, following the initial disclosure on March 23, 2026, with public proof-of-concept released on April 30, 2026. The vulnerability poses a significant risk, especially in multi-tenant environments like cloud services and Kubernetes, where it can enable container escapes. Security teams are urged to apply patches immediately to mitigate risks associated with this critical flaw. 227 sources 73

Extracted Entities

Platforms (5)

Aes-gcm IPSec IPv6 Nat-t NAT Traversal