CVE-2026-77205

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77205", "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "state": "PUBLISHED", "assignerShortName": "libreswan", "dateReserved": "2026-08-20T18:13:09.377Z", "datePublished": "2026-10-13T21:28:03.390Z", "dateUpdated": "2026-10-16T15:31:54.457Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "shortName": "libreswan", "dateUpdated": "2026-10-13T21:28:03.390Z"}, "title": "Denial of Service via sending bogus X.509 certificates", "descriptions": [{"lang": "en", "value": "Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted."}], "affected": [{"vendor": "The Libreswan Project", "product": "libreswan", "packageName": "libreswan", "collectionURL": "https://github.com/libreswan/libreswan", "repo": "https://github.com/libreswan/libreswan", "versions": [{"version": "5.3", "status": "affected", "lessThanOrEqual": "5.3.2", "versionType": "semver"}, {"version": "5.3.3", "status": "unaffected", "versionType": "semver"}], "defaultStatus": "unaffected", "programRoutines": [{"name": "add_decoded_cert"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of service by preventing legitimate peers from connecting through cache poisoning with bogus certificates"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 3.7, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}}, {"other": {"type": "vendorSeverity", "content": {"value": "LOW", "description": "Vendor-assessed severity: Low. Exploitation requires FIPS mode to be enabled and either guessing or learning certificate serial numbers. Certificate Authorities should use randomized serial numbers per best practice."}}}], "workarounds": [{"lang": "en", "value": "Disabling FIPS mode will prevent this attack vector. If this is not possible, upgrade to a later libreswan version or apply the available patch."}], "solutions": [{"lang": "en", "value": "Upgrade to libreswan 5.3.3 or later. Patches are available at https://libreswan.org/security/CVE-2026-77205/"}], "exploits": [{"lang": "en", "value": "No known exploitation in the wild. An attacker could trick a peer into connecting to them first to learn the serial number, then use that to prevent the peer from connecting to the legitimate server. Exploitation requires FIPS mode to be enabled."}], "configurations": [{"lang": "en", "value": "Only configurations running in FIPS mode are vulnerable. Verify FIPS mode and loaded CA certificates with 'sudo ipsec fipsstatus' and 'sudo ipsec listcacerts'."}], "credits": [{"lang": "en", "type": "finder", "value": "Wojciech Tatarski (TuxCare)"}], "source": {"discovery": "EXTERNAL", "defects": ["CVE-2026-77205"]}, "references": [{"name": "Libreswan Security Advisory CVE-2026-77205", "url": "https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt", "tags": ["vendor-advisory"]}, {"name": "Libreswan CVE-2026-77205 Patches", "url": "https://libreswan.org/security/CVE-2026-77205/", "tags": ["patch"]}, {"name": "Related: CVE-2026-14957 (incorrect fix being corrected)", "url": "https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt", "tags": ["related"]}], "timeline": [{"time": "2026-07-30T00:00:00.000Z", "lang": "en", "value": "Libreswan was notified of the issue via security@libreswan.org"}, {"time": "2026-09-24T00:00:00.000Z", "lang": "en", "value": "Advanced notice given to supported customers and distributions"}, {"time": "2026-10-05T00:00:00.000Z", "lang": "en", "value": "Public announcement and release of libreswan 5.3.3"}], "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "15.1", "taxonomyRelations": [{"taxonomyId": "T1499.004", "relationshipName": "maps to", "relationshipValue": "Application or System Exploitation (DoS)"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77205", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:28.040688Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:31:54.457Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77205", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:28.040688Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:30:10.683Z"}}], "cna": {"title": "Denial of Service via sending bogus X.509 certificates", "source": {"defects": ["CVE-2026-77205"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Wojciech Tatarski (TuxCare)"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of service by preventing legitimate peers from connecting through cache poisoning with bogus certificates"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "vendorSeverity", "content": {"value": "LOW", "description": "Vendor-assessed severity: Low. Exploitation requires FIPS mode to be enabled and either guessing or learning certificate serial numbers. Certificate Authorities should use randomized serial numbers per best practice."}}}], "affected": [{"repo": "https://github.com/libreswan/libreswan", "vendor": "The Libreswan Project", "product": "libreswan", "versions": [{"status": "affected", "version": "5.3", "versionType": "semver", "lessThanOrEqual": "5.3.2"}, {"status": "unaffected", "version": "5.3.3", "versionType": "semver"}], "packageName": "libreswan", "collectionURL": "https://github.com/libreswan/libreswan", "defaultStatus": "unaffected", "programRoutines": [{"name": "add_decoded_cert"}]}], "exploits": [{"lang": "en", "value": "No known exploitation in the wild. An attacker could trick a peer into connecting to them first to learn the serial number, then use that to prevent the peer from connecting to the legitimate server. Exploitation requires FIPS mode to be enabled."}], "timeline": [{"lang": "en", "time": "2026-07-30T00:00:00.000Z", "value": "Libreswan was notified of the issue via security@libreswan.org"}, {"lang": "en", "time": "2026-09-24T00:00:00.000Z", "value": "Advanced notice given to supported customers and distributions"}, {"lang": "en", "time": "2026-10-05T00:00:00.000Z", "value": "Public announcement and release of libreswan 5.3.3"}], "solutions": [{"lang": "en", "value": "Upgrade to libreswan 5.3.3 or later. Patches are available at https://libreswan.org/security/CVE-2026-77205/"}], "references": [{"url": "https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt", "name": "Libreswan Security Advisory CVE-2026-77205", "tags": ["vendor-advisory"]}, {"url": "https://libreswan.org/security/CVE-2026-77205/", "name": "Libreswan CVE-2026-77205 Patches", "tags": ["patch"]}, {"url": "https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt", "name": "Related: CVE-2026-14957 (incorrect fix being corrected)", "tags": ["related"]}], "workarounds": [{"lang": "en", "value": "Disabling FIPS mode will prevent this attack vector. If this is not possible, upgrade to a later libreswan version or apply the available patch."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime"}]}], "configurations": [{"lang": "en", "value": "Only configurations running in FIPS mode are vulnerable. Verify FIPS mode and loaded CA certificates with 'sudo ipsec fipsstatus' and 'sudo ipsec listcacerts'."}], "providerMetadata": {"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "shortName": "libreswan", "dateUpdated": "2026-10-13T21:28:03.390Z"}, "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "15.1", "taxonomyRelations": [{"taxonomyId": "T1499.004", "relationshipName": "maps to", "relationshipValue": "Application or System Exploitation (DoS)"}]}]}}, "cveMetadata": {"cveId": "CVE-2026-77205", "state": "PUBLISHED", "dateUpdated": "2026-10-16T15:31:54.457Z", "dateReserved": "2026-08-20T18:13:09.377Z", "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "datePublished": "2026-10-13T21:28:03.390Z", "assignerShortName": "libreswan"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/libreswan/libreswan", "defaultStatus": "unaffected", "packageName": "libreswan", "product": "libreswan", "programRoutines": [{"name": "add_decoded_cert"}], "repo": "https://github.com/libreswan/libreswan", "vendor": "The Libreswan Project", "versions": [{"lessThanOrEqual": "5.3.2", "status": "affected", "version": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.3.3", "versionType": "semver"}]}], "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted."}], "id": "CVE-2026-77205", "lastModified": "2026-10-16T19:55:59.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77205", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:14:28.040688Z", "version": "2.0.3"}}]}, "published": "2026-10-13T22:18:24.577", "references": [{"source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "url": "https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt"}, {"source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "url": "https://libreswan.org/security/CVE-2026-77205/"}, {"source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "url": "https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt"}], "sourceIdentifier": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-772"}], "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "type": "Secondary"}]}

{"bugzilla": {"description": "libreswan: Denial of Service via sending bogus X.509 certificates", "id": "2550255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550255"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-459", "details": ["A flaw was found in Libreswan's handling of malformed X.509 certificates when running in FIPS mode. A remote attacker may cause a rejected certificate to remain in the NSS certificate cache, resulting in legitimate certificates with the same serial number being rejected. This can prevent affected peers from establishing connections until the Libreswan service is restarted."], "mitigation": {"lang": "en:us", "value": "Disabling FIPS mode will prevent this attack vector. However, disabling FIPS mode may violate security or compliance requirements and should not be used as a workaround without authorization."}, "name": "CVE-2026-77205", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:9::fastdatapath", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Fast Datapath for RHEL 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "libreswan", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77205\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77205\nhttps://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt\nhttps://libreswan.org/security/CVE-2026-77205/libreswan-5.3-CVE-2026-77205.patch"], "statement": "This vulnerability is rated as having a Low impact because exploitation requires the system to operate in FIPS mode and depends on an adversary correctly guessing or intercepting certificate serial numbers, making attack complexity as high. Furthermore, the issue only produces a targeted denial of service by temporarily preventing legitimate peers with matching serial numbers from connecting, without causing daemon crashes or compromising system data, indicating low impact to Availability.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.3,5.3.2]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.3.3"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "libreswan", "source": "cna", "vendor": "The Libreswan Project"}, "product": "libreswan", "vendor": "libreswan"}], "created": "2026-10-14T17:30:04.780831+00:00", "updated": "2026-10-26T22:49:43.754404+00:00", "vendors": ["libreswan", "libreswan$PRODUCT$libreswan"]}