Vulnerability-Lookup

RHSA-2026:89748

Vulnerability from csaf_opensuse - Published: 2026-10-26 02:43 - Updated: 2026-10-27 04:08

Summary

Red Hat Security Advisory: libreswan security update

Severity

Important

Notes

Topic: An update for libreswan is now available for Red Hat Enterprise Linux 9.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453) * libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206) * libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-77206

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 13 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-77207

A null pointer dereference flaw was found in Libreswan's PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 13 products, the same list as for CVE-2026-77206

Threats

Impact Moderate

CVE-2026-94453

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 - Use After Free

Affected products

Fixed 13 products, the same list as for CVE-2026-77206

Threats

Impact Important

References

27 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:89748	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2550254	external
https://bugzilla.redhat.com/show_bug.cgi?id=2550256	external
https://bugzilla.redhat.com/show_bug.cgi?id=2550258	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-77206	self
https://bugzilla.redhat.com/show_bug.cgi?id=2550256	external
https://www.cve.org/CVERecord?id=CVE-2026-77206	external
https://nvd.nist.gov/vuln/detail/CVE-2026-77206	external
https://libreswan.org/security/CVE-2026-77206/CVE…	external
https://libreswan.org/security/CVE-2026-77206/lib…	external
https://libreswan.org/security/CVE-2026-77206/lib…	external
https://access.redhat.com/security/cve/CVE-2026-77207	self
https://bugzilla.redhat.com/show_bug.cgi?id=2550258	external
https://www.cve.org/CVERecord?id=CVE-2026-77207	external
https://nvd.nist.gov/vuln/detail/CVE-2026-77207	external
https://libreswan.org/security/CVE-2026-77207/CVE…	external
https://libreswan.org/security/CVE-2026-77207/lib…	external
https://libreswan.org/security/CVE-2026-77207/lib…	external
https://access.redhat.com/security/cve/CVE-2026-94453	self
https://bugzilla.redhat.com/show_bug.cgi?id=2550254	external
https://www.cve.org/CVERecord?id=CVE-2026-94453	external
https://nvd.nist.gov/vuln/detail/CVE-2026-94453	external
https://libreswan.org/security/CVE-2026-94453/CVE…	external
https://libreswan.org/security/CVE-2026-94453/lib…	external
https://libreswan.org/security/CVE-2026-94453/lib…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for libreswan is now available for Red Hat Enterprise Linux 9.8 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)\n\n* libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)\n\n* libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:89748",
        "url": "https://access.redhat.com/errata/RHSA-2026:89748"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2550254",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550254"
      },
      {
        "category": "external",
        "summary": "2550256",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550256"
      },
      {
        "category": "external",
        "summary": "2550258",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550258"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89748.json"
      }
    ],
    "title": "Red Hat Security Advisory: libreswan security update",
    "tracking": {
      "current_release_date": "2026-10-27T04:08:12+00:00",
      "generator": {
        "date": "2026-10-27T04:08:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:89748",
      "initial_release_date": "2026-10-26T02:43:58+00:00",
      "revision_history": [
        {
          "date": "2026-10-26T02:43:58+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-26T02:43:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-27T04:08:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-11.el9_8.src",
                "product": {
                  "name": "libreswan-0:4.15-11.el9_8.src",
                  "product_id": "libreswan-0:4.15-11.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-11.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-11.el9_8.aarch64",
                "product": {
                  "name": "libreswan-0:4.15-11.el9_8.aarch64",
                  "product_id": "libreswan-0:4.15-11.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-11.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debugsource-0:4.15-11.el9_8.aarch64",
                "product": {
                  "name": "libreswan-debugsource-0:4.15-11.el9_8.aarch64",
                  "product_id": "libreswan-debugsource-0:4.15-11.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debugsource@4.15-11.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
                "product": {
                  "name": "libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
                  "product_id": "libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debuginfo@4.15-11.el9_8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-11.el9_8.ppc64le",
                "product": {
                  "name": "libreswan-0:4.15-11.el9_8.ppc64le",
                  "product_id": "libreswan-0:4.15-11.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-11.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
                "product": {
                  "name": "libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
                  "product_id": "libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debugsource@4.15-11.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
                "product": {
                  "name": "libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
                  "product_id": "libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debuginfo@4.15-11.el9_8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-11.el9_8.s390x",
                "product": {
                  "name": "libreswan-0:4.15-11.el9_8.s390x",
                  "product_id": "libreswan-0:4.15-11.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-11.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debugsource-0:4.15-11.el9_8.s390x",
                "product": {
                  "name": "libreswan-debugsource-0:4.15-11.el9_8.s390x",
                  "product_id": "libreswan-debugsource-0:4.15-11.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debugsource@4.15-11.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debuginfo-0:4.15-11.el9_8.s390x",
                "product": {
                  "name": "libreswan-debuginfo-0:4.15-11.el9_8.s390x",
                  "product_id": "libreswan-debuginfo-0:4.15-11.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debuginfo@4.15-11.el9_8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-11.el9_8.x86_64",
                "product": {
                  "name": "libreswan-0:4.15-11.el9_8.x86_64",
                  "product_id": "libreswan-0:4.15-11.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-11.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debugsource-0:4.15-11.el9_8.x86_64",
                "product": {
                  "name": "libreswan-debugsource-0:4.15-11.el9_8.x86_64",
                  "product_id": "libreswan-debugsource-0:4.15-11.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debugsource@4.15-11.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
                "product": {
                  "name": "libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
                  "product_id": "libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debuginfo@4.15-11.el9_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-11.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64"
        },
        "product_reference": "libreswan-0:4.15-11.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-11.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le"
        },
        "product_reference": "libreswan-0:4.15-11.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-11.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x"
        },
        "product_reference": "libreswan-0:4.15-11.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-11.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src"
        },
        "product_reference": "libreswan-0:4.15-11.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-11.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64"
        },
        "product_reference": "libreswan-0:4.15-11.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debuginfo-0:4.15-11.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64"
        },
        "product_reference": "libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debuginfo-0:4.15-11.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le"
        },
        "product_reference": "libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debuginfo-0:4.15-11.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x"
        },
        "product_reference": "libreswan-debuginfo-0:4.15-11.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debuginfo-0:4.15-11.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64"
        },
        "product_reference": "libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debugsource-0:4.15-11.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64"
        },
        "product_reference": "libreswan-debugsource-0:4.15-11.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debugsource-0:4.15-11.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le"
        },
        "product_reference": "libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debugsource-0:4.15-11.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x"
        },
        "product_reference": "libreswan-debugsource-0:4.15-11.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debugsource-0:4.15-11.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
        },
        "product_reference": "libreswan-debugsource-0:4.15-11.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-77206",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-10-13T07:34:21.126000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550256"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A null pointer dereference flaw was found in Libreswan\u0027s IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this vulnerability as having a Moderate impact. Exploitation requires Libreswan to be running as an IKEv2 endpoint, a configuration that requires explicit installation and service configuration on a standard Red Hat Enterprise Linux system. A remote, unauthenticated attacker can send a crafted IKEv2 authentication packet to crash the pluto daemon, potentially disrupting VPN connectivity. Repeated exploitation can cause continued denial of service. Remote code execution is not possible.\n\nThe vulnerability can be triggered even when EAP is not configured.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77206"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550256",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550256"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77206",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77206"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77206",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77206"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt",
          "url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.3-CVE-2026-77206.patch",
          "url": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.3-CVE-2026-77206.patch"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.4-CVE-2026-77206.patch",
          "url": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.4-CVE-2026-77206.patch"
        }
      ],
      "release_date": "2026-10-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T02:43:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89748"
        },
        {
          "category": "workaround",
          "details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code"
    },
    {
      "cve": "CVE-2026-77207",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-10-13T07:34:23.608000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A null pointer dereference flaw was found in Libreswan\u0027s PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact for Red Hat because exploitation requires Libreswan to be deployed, configured, and running as an IKEv2 endpoint, which is not the default configuration of a general-purpose Red Hat Enterprise Linux installation. A remote, unauthenticated attacker can send a crafted IKEv2 packet to crash the Libreswan daemon, potentially disrupting VPN connectivity. Although, systemd supervision typically restarts the crashed process automatically, reducing the persistence of service interruptions, repeated exploitation can cause continued denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77207"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77207",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77207"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77207",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77207"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt",
          "url": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.3-CVE-2026-77207.patch",
          "url": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.3-CVE-2026-77207.patch"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.4-CVE-2026-77207.patch",
          "url": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.4-CVE-2026-77207.patch"
        }
      ],
      "release_date": "2026-10-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T02:43:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89748"
        },
        {
          "category": "workaround",
          "details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS"
    },
    {
      "cve": "CVE-2026-94453",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-10-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550254"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free flaw was found in Libreswan\u0027s IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this vulnerability as having an Important security impact. A remote, unauthenticated attacker may exploit a use-after-free in Libreswan\u0027s IKE-over-TCP handling before peer authentication to cause the IKE daemon to crash and restart. Repeated exploitation can result in denial of service.\n\nThe vulnerability affects only configurations that explicitly enable IKE-over-TCP using `listen-tcp=yes`; this option is not enabled by default. Consequently, exposure is limited to systems configured to accept IKE-over-TCP connections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94453"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550254",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550254"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94453",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94453"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94453",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94453"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt",
          "url": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.3-CVE-2026-94453.patch",
          "url": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.3-CVE-2026-94453.patch"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.4-CVE-2026-94453.patch",
          "url": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.4-CVE-2026-94453.patch"
        }
      ],
      "release_date": "2026-10-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T02:43:58+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:89748"
        },
        {
          "category": "workaround",
          "details": "If IKE-over-TCP is not required, administrators can temporarily mitigate this vulnerability by setting `listen-tcp=no` in the Libreswan configuration. This disables the vulnerable IKE-over-TCP functionality. \n\nIf IKE-over-TCP is required, administrators should restrict access to the listener to trusted peers where practical and apply the appropriate security update once available.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-11.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-11.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP"
    }
  ]
}

CVE-2026-77206 (GCVE-0-2026-77206)

Vulnerability from cvelistv5 – Published: 2026-10-13 21:28 – Updated: 2026-10-16 15:31

Title

IKEv2 pre-authentication Null Pointer Dereference in EAP code

Summary

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:14 UTC

CWE

CWE-476 - Null Pointer Dereference

Assigner

libreswan CNA under the mitre root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://libreswan.org/security/CVE-2026-77206/CVE…	vendor-advisory
https://libreswan.org/security/CVE-2026-77206/	patch

Impacted products

1 product

Vendor	Product	Version
The Libreswan Project	libreswan	Affected: 4.7 , ≤ 5.3.2 (semver) Affected: 5.4 , ≤ 5.4 (semver) Unaffected: 5.3.3 (semver) Unaffected: 5.4.1 (semver)

Credits

Claude (Anthropic) David Korczynski (ADA Logics Ltd)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77206",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:14:41.074180Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:31:54.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/libreswan/libreswan",
          "defaultStatus": "unaffected",
          "packageName": "libreswan",
          "product": "libreswan",
          "repo": "https://github.com/libreswan/libreswan",
          "vendor": "The Libreswan Project",
          "versions": [
            {
              "lessThanOrEqual": "5.3.2",
              "status": "affected",
              "version": "4.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4",
              "status": "affected",
              "version": "5.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.3.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Any server or client that accepts IKEv2 connections is vulnerable. The bug can be triggered even if EAP is not configured at all."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude (Anthropic)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "David Korczynski (ADA Logics Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libreswan\u0027s IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike-\u003esa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "No known exploitation in the wild. Exploitation requires sending a malicious IKE_AUTH packet and does not require peer authentication."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of service via null pointer dereference in EAP handling code when processing malicious IKE_AUTH packets"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "description": "Vendor-assessed severity: Medium. Exploitation does not require authentication, but the daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service.",
              "value": "MEDIUM"
            },
            "type": "vendorSeverity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: Null Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T21:28:11.498Z",
        "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "shortName": "libreswan"
      },
      "references": [
        {
          "name": "Libreswan Security Advisory CVE-2026-77206",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
        },
        {
          "name": "Libreswan CVE-2026-77206 Patches",
          "tags": [
            "patch"
          ],
          "url": "https://libreswan.org/security/CVE-2026-77206/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Note that EAP was not functional in libreswan 5.3. If you need EAP support, use 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77206/"
        }
      ],
      "source": {
        "defects": [
          "CVE-2026-77206"
        ],
        "discovery": "EXTERNAL"
      },
      "taxonomyMappings": [
        {
          "taxonomyName": "ATT\u0026CK",
          "taxonomyRelations": [
            {
              "relationshipName": "maps to",
              "relationshipValue": "Application or System Exploitation (DoS)",
              "taxonomyId": "T1499.004"
            }
          ],
          "taxonomyVersion": "15.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-05T00:00:00.000Z",
          "value": "Libreswan was notified of the issue via security@libreswan.org"
        },
        {
          "lang": "en",
          "time": "2026-09-24T00:00:00.000Z",
          "value": "Advanced notice given to supported customers and distributions"
        },
        {
          "lang": "en",
          "time": "2026-10-05T00:00:00.000Z",
          "value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"
        }
      ],
      "title": "IKEv2 pre-authentication Null Pointer Dereference in EAP code",
      "workarounds": [
        {
          "lang": "en",
          "value": "Apply the available patch or upgrade to a supported version. No configuration-based workaround is available."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
    "assignerShortName": "libreswan",
    "cveId": "CVE-2026-77206",
    "datePublished": "2026-10-13T21:28:11.498Z",
    "dateReserved": "2026-08-20T18:13:09.377Z",
    "dateUpdated": "2026-10-16T15:31:54.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77207 (GCVE-0-2026-77207)

Vulnerability from cvelistv5 – Published: 2026-10-13 21:28 – Updated: 2026-10-16 15:31

Title

Null Pointer Dereference in PKCS#7 bundle with no certificates

Summary

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:14 UTC

CWE

CWE-476 - Null Pointer Dereference
CWE-252 - Unchecked Return Value

Assigner

libreswan CNA under the mitre root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://libreswan.org/security/CVE-2026-77207/CVE…	vendor-advisory
https://libreswan.org/security/CVE-2026-77207/	patch

Impacted products

1 product

Vendor	Product	Version
The Libreswan Project	libreswan	Affected: 4.7 , ≤ 5.3.2 (semver) Affected: 5.4 , ≤ 5.4 (semver) Unaffected: 5.3.3 (semver) Unaffected: 5.4.1 (semver)

Credits

Claude (Anthropic) David Korczynski (ADA Logics Ltd)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77207",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:14:50.209248Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:31:53.986Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/libreswan/libreswan",
          "defaultStatus": "unaffected",
          "packageName": "libreswan",
          "product": "libreswan",
          "programRoutines": [
            {
              "name": "decode_cert_payloads"
            }
          ],
          "repo": "https://github.com/libreswan/libreswan",
          "vendor": "The Libreswan Project",
          "versions": [
            {
              "lessThanOrEqual": "5.3.2",
              "status": "affected",
              "version": "4.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4",
              "status": "affected",
              "version": "5.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.3.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Any server or client that accepts IKEv2 connections with certificate-based authentication is vulnerable."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude (Anthropic)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "David Korczynski (ADA Logics Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "No known exploitation in the wild. Exploitation requires sending a malicious IKE CERT payload with a PKCS#7 SignedData containing a CRL but no certificates, and does not require peer authentication."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of service via null pointer dereference in PKCS#7 certificate handling when processing malicious IKE_AUTH packets"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "description": "Vendor-assessed severity: Medium. Exploitation does not require authentication, but the daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service.",
              "value": "MEDIUM"
            },
            "type": "vendorSeverity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: Null Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "CWE-252: Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T21:28:19.219Z",
        "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "shortName": "libreswan"
      },
      "references": [
        {
          "name": "Libreswan Security Advisory CVE-2026-77207",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt"
        },
        {
          "name": "Libreswan CVE-2026-77207 Patches",
          "tags": [
            "patch"
          ],
          "url": "https://libreswan.org/security/CVE-2026-77207/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77207/"
        }
      ],
      "source": {
        "defects": [
          "CVE-2026-77207"
        ],
        "discovery": "EXTERNAL"
      },
      "taxonomyMappings": [
        {
          "taxonomyName": "ATT\u0026CK",
          "taxonomyRelations": [
            {
              "relationshipName": "maps to",
              "relationshipValue": "Application or System Exploitation (DoS)",
              "taxonomyId": "T1499.004"
            }
          ],
          "taxonomyVersion": "15.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-05T00:00:00.000Z",
          "value": "Libreswan was notified of the issue via security@libreswan.org"
        },
        {
          "lang": "en",
          "time": "2026-09-24T00:00:00.000Z",
          "value": "Advanced notice given to supported customers and distributions"
        },
        {
          "lang": "en",
          "time": "2026-10-05T00:00:00.000Z",
          "value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"
        }
      ],
      "title": "Null Pointer Dereference in PKCS#7 bundle with no certificates",
      "workarounds": [
        {
          "lang": "en",
          "value": "Apply the available patch or upgrade to a supported version. No configuration-based workaround is available."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
    "assignerShortName": "libreswan",
    "cveId": "CVE-2026-77207",
    "datePublished": "2026-10-13T21:28:19.219Z",
    "dateReserved": "2026-08-20T18:13:09.377Z",
    "dateUpdated": "2026-10-16T15:31:53.986Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-94453 (GCVE-0-2026-94453)

Vulnerability from cvelistv5 – Published: 2026-10-13 21:27 – Updated: 2026-10-16 15:31

Title

IKEv2 Use-After-Free bug when using IKE-over-TCP

Summary

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:14 UTC

CWE

CWE-416 - Use After Free

Assigner

libreswan CNA under the mitre root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://libreswan.org/security/CVE-2026-94453/CVE…	vendor-advisory
https://libreswan.org/security/CVE-2026-94453/	patch

Impacted products

1 product

Vendor	Product	Version
The Libreswan Project	libreswan	Affected: 4.0 , ≤ 5.3.2 (semver) Affected: 5.4 , ≤ 5.4 (semver) Unaffected: 5.3.3 (semver) Unaffected: 5.4.1 (semver)

Credits

Vlad Miu

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-94453",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:14:22.083231Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:31:54.755Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/libreswan/libreswan",
          "defaultStatus": "unaffected",
          "packageName": "libreswan",
          "product": "libreswan",
          "repo": "https://github.com/libreswan/libreswan",
          "vendor": "The Libreswan Project",
          "versions": [
            {
              "lessThanOrEqual": "5.3.2",
              "status": "affected",
              "version": "4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4",
              "status": "affected",
              "version": "5.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.3.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Only configurations with listen-tcp=yes are vulnerable. IKE over TCP is not enabled by default in libreswan."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vlad Miu"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libreswan\u0027s pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa-\u003est_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "No known exploitation in the wild. Exploitation requires IKE over TCP to be enabled (listen-tcp=yes). The vulnerability can be triggered remotely without authentication."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of service and potential remote code execution via use-after-free when processing IKE-over-TCP connections"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "description": "Vendor-assessed severity: High. Exploitation does not require authentication. IKE over TCP is not enabled by default but affects any configuration with listen-tcp=yes.",
              "value": "HIGH"
            },
            "type": "vendorSeverity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T21:27:43.376Z",
        "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "shortName": "libreswan"
      },
      "references": [
        {
          "name": "Libreswan Security Advisory CVE-2026-94453",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt"
        },
        {
          "name": "Libreswan CVE-2026-94453 Patches",
          "tags": [
            "patch"
          ],
          "url": "https://libreswan.org/security/CVE-2026-94453/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-94453/"
        }
      ],
      "source": {
        "defects": [
          "CVE-2026-94453"
        ],
        "discovery": "EXTERNAL"
      },
      "taxonomyMappings": [
        {
          "taxonomyName": "ATT\u0026CK",
          "taxonomyRelations": [
            {
              "relationshipName": "maps to",
              "relationshipValue": "Application or System Exploitation (DoS)",
              "taxonomyId": "T1499.004"
            }
          ],
          "taxonomyVersion": "15.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T00:00:00.000Z",
          "value": "Libreswan was notified of the issue via security@libreswan.org"
        },
        {
          "lang": "en",
          "time": "2026-09-24T00:00:00.000Z",
          "value": "Advanced notice given to supported customers and distributions"
        },
        {
          "lang": "en",
          "time": "2026-10-05T00:00:00.000Z",
          "value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"
        }
      ],
      "title": "IKEv2 Use-After-Free bug when using IKE-over-TCP",
      "workarounds": [
        {
          "lang": "en",
          "value": "To temporarily disable IKE over TCP, set listen-tcp=no."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
    "assignerShortName": "libreswan",
    "cveId": "CVE-2026-94453",
    "datePublished": "2026-10-13T21:27:43.376Z",
    "dateReserved": "2026-09-21T17:09:02.116Z",
    "dateUpdated": "2026-10-16T15:31:54.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:89748

CVE-2026-77206 (GCVE-0-2026-77206)

CVE-2026-77207 (GCVE-0-2026-77207)

CVE-2026-94453 (GCVE-0-2026-94453)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour