Skip to content
OpenAdvisories
High ALAS2-2026-4021 1 CVE

Important: libreswan security update (Amazon Linux 2)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-77207: A null pointer dereference flaw was found in Libreswan's PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 libreswan 0:3.25-4.8.amzn2.0.4
Amazon Linux · 2 libreswan-debuginfo 0:3.25-4.8.amzn2.0.4

Vulnerabilities 1

  • High 7.5
    CVE-2026-77207

    Null Pointer Dereference in PKCS#7 bundle with no certificates

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then ite…

    The Libreswan Project libreswan libreswan libreswan Debian Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-77207.html