Skip to content
OpenAdvisories
Medium WID-SEC-2026-4183 4 CVEs

Red Hat Enterprise Linux Libreswan: Mehrere Schwachstellen ermöglichen Denial of Service

Published Oct 26, 2026 · Updated Nov 10, 2026 · Revision 6 · de

Vendor: Fedora Vendor: Oracle Vendor: Red Hat Vendor: RESF Product: Enterprise Linux Product: Linux Product: Linux Product: Rocky Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux Libreswan ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 4

  • High 7.5
    CVE-2026-77206

    IKEv2 pre-authentication Null Pointer Dereference in EAP code

    Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured …

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-77207

    Null Pointer Dereference in PKCS#7 bundle with no certificates

    Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then ite…

    The Libreswan Project libreswan libreswan libreswan Debian Azure Linux Alpine
  • High 7.5
    CVE-2026-94453

    IKEv2 Use-After-Free bug when using IKE-over-TCP

    Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes …

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  • Low 3.7
    CVE-2026-77205

    Denial of Service via sending bogus X.509 certificates

    Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimat…

    The Libreswan Project libreswan libreswan libreswan Debian Ubuntu Alpine

Revision history

  1. #6

    Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

  2. #5

    Neue Updates von Red Hat aufgenommen

  3. #4

    Neue Updates von Red Hat aufgenommen

  4. #3

    Neue Updates von Fedora aufgenommen

  5. #2

    Neue Updates von Oracle Linux aufgenommen

  6. #1

    Initiale Fassung

References