CVE-2026-77207

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77207", "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "state": "PUBLISHED", "assignerShortName": "libreswan", "dateReserved": "2026-08-20T18:13:09.377Z", "datePublished": "2026-10-13T21:28:19.219Z", "dateUpdated": "2026-10-16T15:31:53.986Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "shortName": "libreswan", "dateUpdated": "2026-10-13T21:28:19.219Z"}, "title": "Null Pointer Dereference in PKCS#7 bundle with no certificates", "descriptions": [{"lang": "en", "value": "Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service."}], "affected": [{"vendor": "The Libreswan Project", "product": "libreswan", "packageName": "libreswan", "collectionURL": "https://github.com/libreswan/libreswan", "repo": "https://github.com/libreswan/libreswan", "versions": [{"version": "4.7", "status": "affected", "lessThanOrEqual": "5.3.2", "versionType": "semver"}, {"version": "5.4", "status": "affected", "lessThanOrEqual": "5.4", "versionType": "semver"}, {"version": "5.3.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.1", "status": "unaffected", "versionType": "semver"}], "defaultStatus": "unaffected", "programRoutines": [{"name": "decode_cert_payloads"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: Null Pointer Dereference"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-252", "description": "CWE-252: Unchecked Return Value"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of service via null pointer dereference in PKCS#7 certificate handling when processing malicious IKE_AUTH packets"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}, {"other": {"type": "vendorSeverity", "content": {"value": "MEDIUM", "description": "Vendor-assessed severity: Medium. Exploitation does not require authentication, but the daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service."}}}], "workarounds": [{"lang": "en", "value": "Apply the available patch or upgrade to a supported version. No configuration-based workaround is available."}], "solutions": [{"lang": "en", "value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77207/"}], "exploits": [{"lang": "en", "value": "No known exploitation in the wild. Exploitation requires sending a malicious IKE CERT payload with a PKCS#7 SignedData containing a CRL but no certificates, and does not require peer authentication."}], "configurations": [{"lang": "en", "value": "Any server or client that accepts IKEv2 connections with certificate-based authentication is vulnerable."}], "credits": [{"lang": "en", "type": "tool", "value": "Claude (Anthropic)"}, {"lang": "en", "type": "reporter", "value": "David Korczynski (ADA Logics Ltd)"}], "source": {"discovery": "EXTERNAL", "defects": ["CVE-2026-77207"]}, "references": [{"name": "Libreswan Security Advisory CVE-2026-77207", "url": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt", "tags": ["vendor-advisory"]}, {"name": "Libreswan CVE-2026-77207 Patches", "url": "https://libreswan.org/security/CVE-2026-77207/", "tags": ["patch"]}], "timeline": [{"time": "2026-08-05T00:00:00.000Z", "lang": "en", "value": "Libreswan was notified of the issue via security@libreswan.org"}, {"time": "2026-09-24T00:00:00.000Z", "lang": "en", "value": "Advanced notice given to supported customers and distributions"}, {"time": "2026-10-05T00:00:00.000Z", "lang": "en", "value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"}], "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "15.1", "taxonomyRelations": [{"taxonomyId": "T1499.004", "relationshipName": "maps to", "relationshipValue": "Application or System Exploitation (DoS)"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77207", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:50.209248Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:31:53.986Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77207", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:50.209248Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:30:01.226Z"}}], "cna": {"title": "Null Pointer Dereference in PKCS#7 bundle with no certificates", "source": {"defects": ["CVE-2026-77207"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "tool", "value": "Claude (Anthropic)"}, {"lang": "en", "type": "reporter", "value": "David Korczynski (ADA Logics Ltd)"}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of service via null pointer dereference in PKCS#7 certificate handling when processing malicious IKE_AUTH packets"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "vendorSeverity", "content": {"value": "MEDIUM", "description": "Vendor-assessed severity: Medium. Exploitation does not require authentication, but the daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service."}}}], "affected": [{"repo": "https://github.com/libreswan/libreswan", "vendor": "The Libreswan Project", "product": "libreswan", "versions": [{"status": "affected", "version": "4.7", "versionType": "semver", "lessThanOrEqual": "5.3.2"}, {"status": "affected", "version": "5.4", "versionType": "semver", "lessThanOrEqual": "5.4"}, {"status": "unaffected", "version": "5.3.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.1", "versionType": "semver"}], "packageName": "libreswan", "collectionURL": "https://github.com/libreswan/libreswan", "defaultStatus": "unaffected", "programRoutines": [{"name": "decode_cert_payloads"}]}], "exploits": [{"lang": "en", "value": "No known exploitation in the wild. Exploitation requires sending a malicious IKE CERT payload with a PKCS#7 SignedData containing a CRL but no certificates, and does not require peer authentication."}], "timeline": [{"lang": "en", "time": "2026-08-05T00:00:00.000Z", "value": "Libreswan was notified of the issue via security@libreswan.org"}, {"lang": "en", "time": "2026-09-24T00:00:00.000Z", "value": "Advanced notice given to supported customers and distributions"}, {"lang": "en", "time": "2026-10-05T00:00:00.000Z", "value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"}], "solutions": [{"lang": "en", "value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77207/"}], "references": [{"url": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt", "name": "Libreswan Security Advisory CVE-2026-77207", "tags": ["vendor-advisory"]}, {"url": "https://libreswan.org/security/CVE-2026-77207/", "name": "Libreswan CVE-2026-77207 Patches", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Apply the available patch or upgrade to a supported version. No configuration-based workaround is available."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476: Null Pointer Dereference"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-252", "description": "CWE-252: Unchecked Return Value"}]}], "configurations": [{"lang": "en", "value": "Any server or client that accepts IKEv2 connections with certificate-based authentication is vulnerable."}], "providerMetadata": {"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "shortName": "libreswan", "dateUpdated": "2026-10-13T21:28:19.219Z"}, "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "15.1", "taxonomyRelations": [{"taxonomyId": "T1499.004", "relationshipName": "maps to", "relationshipValue": "Application or System Exploitation (DoS)"}]}]}}, "cveMetadata": {"cveId": "CVE-2026-77207", "state": "PUBLISHED", "dateUpdated": "2026-10-16T15:31:53.986Z", "dateReserved": "2026-08-20T18:13:09.377Z", "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "datePublished": "2026-10-13T21:28:19.219Z", "assignerShortName": "libreswan"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/libreswan/libreswan", "defaultStatus": "unaffected", "packageName": "libreswan", "product": "libreswan", "programRoutines": [{"name": "decode_cert_payloads"}], "repo": "https://github.com/libreswan/libreswan", "vendor": "The Libreswan Project", "versions": [{"lessThanOrEqual": "5.3.2", "status": "affected", "version": "4.7", "versionType": "semver"}, {"lessThanOrEqual": "5.4", "status": "affected", "version": "5.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.3.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.1", "versionType": "semver"}]}], "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service."}], "id": "CVE-2026-77207", "lastModified": "2026-10-16T19:55:59.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77207", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:14:50.209248Z", "version": "2.0.3"}}]}, "published": "2026-10-13T22:18:26.040", "references": [{"source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "url": "https://libreswan.org/security/CVE-2026-77207/"}, {"source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "url": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt"}], "sourceIdentifier": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-252"}, {"lang": "en", "value": "CWE-476"}], "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "type": "Secondary"}]}

{"bugzilla": {"description": "libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS", "id": "2550258", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550258"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A null pointer dereference flaw was found in Libreswan's PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service."], "mitigation": {"lang": "en:us", "value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available."}, "name": "CVE-2026-77207", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:9::fastdatapath", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Fast Datapath for RHEL 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77207\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77207\nhttps://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt\nhttps://libreswan.org/security/CVE-2026-77207/libreswan-5.3-CVE-2026-77207.patch\nhttps://libreswan.org/security/CVE-2026-77207/libreswan-5.4-CVE-2026-77207.patch"], "statement": "This vulnerability is rated as Moderate impact for Red Hat because exploitation requires Libreswan to be deployed, configured, and running as an IKEv2 endpoint, which is not the default configuration of a general-purpose Red Hat Enterprise Linux installation. A remote, unauthenticated attacker can send a crafted IKEv2 packet to crash the Libreswan daemon, potentially disrupting VPN connectivity. Although, systemd supervision typically restarts the crashed process automatically, reducing the persistence of service interruptions, repeated exploitation can cause continued denial of service.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.7,5.3.2]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.3.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.4.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "libreswan", "source": "cna", "vendor": "The Libreswan Project"}, "product": "libreswan", "vendor": "libreswan"}], "created": "2026-10-14T17:30:04.780572+00:00", "updated": "2026-10-26T22:49:39.032739+00:00", "vendors": ["libreswan", "libreswan$PRODUCT$libreswan"]}