Search: CVE-2026-77206

Libreswan contains a null pointer dereference vulnerability in its IKEv2 state machine's EAP authentication handling. This flaw can be triggered by any IKEv2 connection, even without EAP configured, due to a code inconsistency. A malicious IKE_AUTH packet can cause the pluto daemon to crash and restart, resulting in a denial of service. No remote code execution is possible.