Skip to content
OpenAdvisories
High ALSA-2026:89923 3 CVEs

Important: libreswan security update

Published Oct 26, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

* libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
* libreswan: Denial of Service via sending bogus X.509 certificates (CVE-2026-77205)
* libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 10 libreswan 5.3.3-1.el10_2
AlmaLinux · 10 libreswan-minimal 5.3.3-1.el10_2

Vulnerabilities 3

  • High 7.5
    CVE-2026-77207

    Null Pointer Dereference in PKCS#7 bundle with no certificates

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then ite…

    The Libreswan Project libreswan libreswan libreswan Debian Azure Linux Alpine
  • High 7.5
    CVE-2026-94453

    IKEv2 Use-After-Free bug when using IKE-over-TCP

    Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes …

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2026-77205

    Denial of Service via sending bogus X.509 certificates

    Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimat…

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-77205
  • report
    https://access.redhat.com/security/cve/CVE-2026-77207
  • report
    https://access.redhat.com/security/cve/CVE-2026-94453
  • report
    https://bugzilla.redhat.com/2550254
  • report
    https://bugzilla.redhat.com/2550255
  • report
    https://bugzilla.redhat.com/2550258
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-89923.html