Description
Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.
Published: 2026-10-13
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A null pointer dereference occurs when LibreSwan processes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509 that contains a PKCS#7 blob with a CRL but no certificates. The PKCS#7 handling code incorrectly assumes certificates are present, and when the list of certificates is NULL the software dereferences the pointer, causing a crash and automatic restart. No code execution is possible, but repeated exploitation can lead to a denial‑of‑service through repeated crashes.

Affected Systems

The vulnerability affects all LibreSwan releases prior to version 5.3.3 and prior to 5.4.1. The Libreswan Project’s libreswan product is affected; upgrading to libreswan 5.3.3, 5.4.1, or any later release resolves the issue.

Risk and Exploitability

The CVSS base score of 7.5 reflects a medium‑high severity. The EPSS score of less than 1 % indicates a very low probability of widespread exploitation. The bug is not listed in the CISA KEV catalog. An attacker can trigger the crash by sending a malicious IKE_AUTH packet containing a specially crafted CERT_PKCS7_WRAPPED_X509 payload; the peer does not need to be authenticated. Compromise of a single peer can therefore cause a DoS for the affected device, but there is no known remote code execution path.

Generated by OpenCVE AI on October 16, 2026 at 02:00 UTC.

Remediation

Vendor Solution

Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77207/

Vendor Workaround

Apply the available patch or upgrade to a supported version. No configuration-based workaround is available.

OpenCVE Recommended Actions

  • Upgrade LibreSwan to version 5.3.3, 5.4.1, or any later release.
  • If an upgrade is not possible, download and apply the vendor‑supplied patches – libreswan-5.3-CVE-2026-77207.patch or libreswan-5.4-CVE-2026-77207.patch – to the current installation.
  • Ensure that IKE_AUTH traffic is monitored and that the device has redundancy or graceful failover mechanisms so that a transient crash does not result in prolonged service interruption.

Generated by OpenCVE AI on October 16, 2026 at 02:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Libreswan
Libreswan libreswan
Vendors & Products Libreswan
Libreswan libreswan

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 13 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.
Title Null Pointer Dereference in PKCS#7 bundle with no certificates
Weaknesses CWE-252
CWE-476
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Libreswan Libreswan
cve-icon MITRE

Status: PUBLISHED

Assigner: libreswan

Published:

Updated: 2026-10-16T15:31:53.986Z

Reserved: 2026-08-20T18:13:09.377Z

Link: CVE-2026-77207

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T22:18:26.040

Modified: 2026-10-16T19:55:59.740

Link: CVE-2026-77207

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-05T00:00:00Z

Links: CVE-2026-77207 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T22:49:39Z

Weaknesses