Skip to content
OpenAdvisories
High ELSA-2026-89923 3 CVEs

Important: libreswan security update (Oracle Linux 10)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Oracle Linux

Summary

[5.3.3-1.0.1]
- Add libreswan-oracle.patch to detect Oracle Linux distro

[5.3.3-1]
- update to 5.3.3 to fix CVE-2026-94453, CVE-2026-77207, CVE-2026-77205, and CVE-2026-77206

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 10 libreswan 0:5.3.3-1.0.1.el10_2
Oracle Linux · 10 libreswan-minimal 0:5.3.3-1.0.1.el10_2

Vulnerabilities 3

  • High 7.5
    CVE-2026-77207

    Null Pointer Dereference in PKCS#7 bundle with no certificates

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then ite…

    The Libreswan Project libreswan libreswan libreswan Debian Azure Linux Alpine
  • High 7.5
    CVE-2026-94453

    IKEv2 Use-After-Free bug when using IKE-over-TCP

    Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes …

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2026-77205

    Denial of Service via sending bogus X.509 certificates

    Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimat…

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Alpine