Description
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.
Published: 2026-10-13
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Libreswan's IKEv2 state machine contains a null pointer dereference bug in its EAP handling code. A malicious IKE_AUTH packet, which can be sent even when EAP is not configured, triggers a fall‑through that dereferences a NULL pointer, causing the pluto daemon to crash and automatically restart. The flaw does not allow remote code execution; it only leads to a denial of service by repeatedly crashing the daemon.

Affected Systems

All Libreswan releases prior to 5.3.3 and pre‑5.4.1 5.4 series are affected. The recommended fix is to upgrade to version 5.3.3 or 5.4.1 or any later release that contains the patch.

Risk and Exploitability

The CVSS score of 7.5 indicates a high impact of denial of service, while the EPSS score of less than 1 % shows a very low expected exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it remotely by sending a crafted IKE_AUTH packet over the IKEv2 port without authenticating, leading to repeated crashes of the pluto process and temporary interruption of VPN service.

Generated by OpenCVE AI on October 16, 2026 at 02:00 UTC.

Remediation

Vendor Solution

Upgrade to libreswan 5.3.3 or 5.4.1 or later. Note that EAP was not functional in libreswan 5.3. If you need EAP support, use 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77206/

Vendor Workaround

Apply the available patch or upgrade to a supported version. No configuration-based workaround is available.

OpenCVE Recommended Actions

  • Upgrade to libreswan 5.3.3 or 5.4.1 or newer.
  • If upgrade cannot be performed immediately, apply the published patch from libreswan.org.
  • Ensure the pluto daemon is configured to restart on crash and monitor logs for unexpected crashes to confirm protection has taken effect.

Generated by OpenCVE AI on October 16, 2026 at 02:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Libreswan
Libreswan libreswan
Vendors & Products Libreswan
Libreswan libreswan

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 13 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.
Title IKEv2 pre-authentication Null Pointer Dereference in EAP code
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Libreswan Libreswan
cve-icon MITRE

Status: PUBLISHED

Assigner: libreswan

Published:

Updated: 2026-10-16T15:31:54.304Z

Reserved: 2026-08-20T18:13:09.377Z

Link: CVE-2026-77206

cve-icon Vulnrichment

Updated: 2026-10-16T15:30:06.811Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T22:18:24.727

Modified: 2026-10-16T19:55:59.740

Link: CVE-2026-77206

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-05T00:00:00Z

Links: CVE-2026-77206 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T22:49:41Z

Weaknesses