CVE-2026-77206

7.5High

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-476

Impact

Unauthenticated remote attackers can repeatedly crash the pluto daemon to cause a denial of service. They only need network access to send a malicious IKE_AUTH packet to your IKEv2 endpoint.

Root cause

A fall-through error in the IKEv2 state machine dereferences a NULL pointer (ike->sa.st_eap) during EAP authentication handling even when EAP is disabled.

Affected systems

Libreswan versions are not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade to the fixed Libreswan release once identified in the vendor advisory. If you cannot patch immediately, block untrusted access to IKE UDP ports 500 and 4500 at the perimeter firewall.

shell

$ ipsec version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-77206