Libreswan, an IPsec and IKE implementation for Linux, has multiple security vulnerabilities including a use-after-free bug in IKEv2 when using IKE-over-TCP (CVE-2026-94453), a denial of service via bogus X.509 certificates (CVE-2026-77205), and a null pointer dereference in PKCS#7 bundles with no certificates (CVE-2026-77207). These issues affect versions prior to 5.3.3-1.el10_2. A security update fixing these vulnerabilities is available.