CVE-2026-77207

7.5High

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-252, CWE-476

Impact

Remote unauthenticated attackers can crash the Libreswan service by sending a crafted IKE_AUTH packet, causing a denial of service. The attack requires network access to the IKE port but does not permit code execution.

Root cause

Libreswan dereferences a null pointer when parsing a PKCS#7 CERT payload that contains a CRL but no certificates, because NSS API SEC_PKCS7GetCertificateList() returns NULL.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade Libreswan to the patched release referenced in the advisory. If immediate patching is not possible, restrict IKE network access (UDP 500/4500) to trusted peer IPs via firewall rules.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-77207