CVE-2026-77207 is a high-severity vulnerability in Libreswan affecting versions 4.7 through 5.3.2 and 5.4 through 5.4. It involves a null pointer dereference in the PKCS#7 handling code during IKE certificate authentication. This flaw can be triggered by a malicious IKE_AUTH packet without requiring peer authentication, causing the Libreswan process to crash and restart, resulting in a denial of service. No remote code execution or data compromise is possible.
Libreswan contains a null pointer dereference vulnerability in its IKEv2 state machine's EAP authentication handling. This flaw can be triggered by any IKEv2 connection, even without EAP configured, due to a code inconsistency. A malicious IKE_AUTH packet can cause the pluto daemon to crash and restart, resulting in a denial of service. No remote code execution is possible.
Libreswan versions 5.3 through 5.3.2 running in FIPS mode have a vulnerability where malformed certificates are rejected but not removed from the NSS cache. This causes legitimate certificates with the same serial number to be rejected, potentially locking out legitimate peers until the service restarts. The issue stems from a missing call to CERT_DestroyCertificate() in the add_decoded_cert() function, related to an incorrect fix for a previous vulnerability (CVE-2026-14957).
Libreswan's pluto daemon contains a use-after-free vulnerability (CVE-2026-94453) triggered when a client using IKE over TCP closes the connection and another packet is received for the same tuple. This causes the daemon to crash and restart, potentially leading to denial of service. The vulnerability exists because the IKE state retains a pointer to a freed iface_endpoint. Remote code execution may be possible. The vulnerability affects configurations with listen-tcp=yes enabled, which is not the default. Versions from 4.0 up to and including 5.3.2 and 5.4 up to and including 5.4 are affected.
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.
Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.
The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.