Skip to content
OpenAdvisories
High RHSA-2026:98046 4 CVEs

Red Hat Security Advisory: libreswan security, bug fix, and enhancement update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::fastdatapath libreswan 0:5.3.3-3.el9fdp
Red Hat · RHEL 9 enterprise_linux:9::fastdatapath libreswan-debuginfo 0:5.3.3-3.el9fdp
Red Hat · RHEL 9 enterprise_linux:9::fastdatapath libreswan-debugsource 0:5.3.3-3.el9fdp

Vulnerabilities 4

  • High 7.5
    CVE-2026-77206

    IKEv2 pre-authentication Null Pointer Dereference in EAP code

    Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured …

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-77207

    Null Pointer Dereference in PKCS#7 bundle with no certificates

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then ite…

    The Libreswan Project libreswan libreswan libreswan Debian Azure Linux Alpine
  • High 7.5
    CVE-2026-94453

    IKEv2 Use-After-Free bug when using IKE-over-TCP

    Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes …

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2026-77205

    Denial of Service via sending bogus X.509 certificates

    Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimat…

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550254
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550255
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550256
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2550258
  • article
    https://issues.redhat.com/browse/FDP-4314
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_98046.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-77205
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-77205
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-77205
  • article
    https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt
  • article
    https://libreswan.org/security/CVE-2026-77205/libreswan-5.3-CVE-2026-77205.patch
  • report
    https://access.redhat.com/security/cve/CVE-2026-77206
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-77206
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-77206
  • article
    https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt
  • article
    https://libreswan.org/security/CVE-2026-77206/libreswan-5.3-CVE-2026-77206.patch
  • article
    https://libreswan.org/security/CVE-2026-77206/libreswan-5.4-CVE-2026-77206.patch
  • report
    https://access.redhat.com/security/cve/CVE-2026-77207
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-77207
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-77207
  • article
    https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt
  • article
    https://libreswan.org/security/CVE-2026-77207/libreswan-5.3-CVE-2026-77207.patch
  • article
    https://libreswan.org/security/CVE-2026-77207/libreswan-5.4-CVE-2026-77207.patch
  • report
    https://access.redhat.com/security/cve/CVE-2026-94453
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-94453
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-94453
  • article
    https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt
  • article
    https://libreswan.org/security/CVE-2026-94453/libreswan-5.3-CVE-2026-94453.patch
  • article
    https://libreswan.org/security/CVE-2026-94453/libreswan-5.4-CVE-2026-94453.patch