Log in Start free

Vulnerability · Published Oct 13, 2026 · Assigned by libreswan

CVE-2026-77207Null Pointer Dereference in PKCS#7 bundle with no certificates

High 7.5

In plain English

A high-severity null pointer dereference in libreswan from The Libreswan Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 59.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10libreswan5.3.3-1.el10_2ALSA-2026:89923
AlmaLinux:8libreswan4.12-2.el8_10.7ALSA-2026:90492
AlmaLinux:9libreswan4.15-11.el9_8ALSA-2026:89748
AlmaLinux:10libreswan-minimal5.3.3-1.el10_2ALSA-2026:89923
Alpine:v3.23libreswan5.3.3-r0ALPINE-CVE-2026-77207
Alpine:v3.24libreswan5.3.3-r0ALPINE-CVE-2026-77207
Debian:12libreswanno fix listedDEBIAN-CVE-2026-77207
Debian:13libreswanno fix listedDEBIAN-CVE-2026-77207
Rocky Linux:10libreswan0:5.3.3-1.el10_2RLSA-2026:89923
Rocky Linux:8libreswan0:4.12-2.el8_10.7RLSA-2026:90492
Rocky Linux:9libreswan0:4.15-11.el9_8RLSA-2026:89748

Affected products (as reported)

VendorProductVersions
The Libreswan Project libreswan 4.7 – through 5.3.25.4 – through 5.4

Weakness: CWE-476, CWE-252 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References