Vulnerability · Published Oct 13, 2026 · Assigned by libreswan
CVE-2026-77205Denial of Service via sending bogus X.509 certificates
Low 3.7
In plain English
A low-severity security flaw in libreswan from The Libreswan Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | libreswan | 5.3.3-1.el10_2 | ALSA-2026:89923 |
| AlmaLinux:10 | libreswan-minimal | 5.3.3-1.el10_2 | ALSA-2026:89923 |
| Alpine:v3.23 | libreswan | 5.3.3-r0 | ALPINE-CVE-2026-77205 |
| Alpine:v3.24 | libreswan | 5.3.3-r0 | ALPINE-CVE-2026-77205 |
| Debian:14 | libreswan | no fix listed | DEBIAN-CVE-2026-77205 |
| Rocky Linux:10 | libreswan | 0:5.3.3-1.el10_2 | RLSA-2026:89923 |
| Ubuntu:22.04:LTS | libreswan | no fix listed | UBUNTU-CVE-2026-77205 |
| Ubuntu:24.04:LTS | libreswan | no fix listed | UBUNTU-CVE-2026-77205 |
| Ubuntu:26.04:LTS | libreswan | no fix listed | UBUNTU-CVE-2026-77205 |
| Ubuntu:26.10 | libreswan | no fix listed | UBUNTU-CVE-2026-77205 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Libreswan Project | libreswan | 5.3 – through 5.3.2 |
Weakness: CWE-772 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L