Description
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Libreswan Project | libreswan | 4.7 – ≤ 5.3.2, 5.4 – ≤ 5.4 | 5.3.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | libreswan | No fix yet | — |
| Debian 12 | libreswan | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libreswan | No fix yet | — |
| Ubuntu 26.04 LTS | libreswan | No fix yet | — |
| Ubuntu 24.04 LTS | libreswan | No fix yet | — |
| Ubuntu 22.04 LTS | libreswan | No fix yet | — |
| Ubuntu 20.04 LTS | libreswan | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libreswan | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | libreswan | 4.15-11.el9_8 | ALSA-2026:89748 |
| AlmaLinux 8 | libreswan | 4.12-2.el8_10.7 | ALSA-2026:90492 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libreswan +1 | 5.4.1-1.el10_3 | RLSA-2026:98088 |
| Rocky Linux 9 | libreswan | 4.15-11.el9_8 | RLSA-2026:97878, RLSA-2026:89748 |
| Rocky Linux 8 | libreswan | 4.12-2.el8_10.7 | RLSA-2026:90492 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libreswan | 5.3.3-r0 | — |
| Alpine v3.23 | libreswan | 5.3.3-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libreswan | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | libreswan | 4.15-11.0.1.el9_8 | ELSA-2026-89748 |
| Oracle Linux 8 | libreswan | 4.12-2.0.1.el8_10.7 | ELSA-2026-90492 |
Advisories 9
- RLSA-2026:98088 Important: libreswan security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97878 Important: libreswan security update Rocky Linux Security Advisories · Nov 11, 2026
- WID-SEC-2026-4183 Red Hat Enterprise Linux Libreswan: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 10, 2026
- RLSA-2026:90492 Important: libreswan security update Rocky Linux Security Advisories · Oct 29, 2026
- ALSA-2026:89748 Important: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:90492 Important: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:89748 Important: libreswan security update Rocky Linux Security Advisories · Oct 27, 2026
- ELSA-2026-90492 Important: libreswan security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 27, 2026
- ELSA-2026-89748 Important: libreswan security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 26, 2026
References
- Libreswan Security Advisory CVE-2026-77206 vendor-advisory
- Libreswan CVE-2026-77206 Patches patch