Description
Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Libreswan Project | libreswan | 4.7 – ≤ 5.3.2, 5.4 – ≤ 5.4 | 5.3.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | libreswan | No fix yet | — |
| Debian 12 | libreswan | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libreswan +1 | 5.3.3-1.el10_2 | ALSA-2026:89923 |
| AlmaLinux 9 | libreswan | 4.15-11.el9_8 | ALSA-2026:89748 |
| AlmaLinux 8 | libreswan | 4.12-2.el8_10.7 | ALSA-2026:90492 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libreswan | 5.3.3-1.el10_2 | RLSA-2026:98088, RLSA-2026:89923 |
| Rocky Linux 10 | libreswan-minimal | 5.4.1-1.el10_3 | RLSA-2026:98088 |
| Rocky Linux 9 | libreswan | 4.15-11.el9_8 | RLSA-2026:97878, RLSA-2026:89748 |
| Rocky Linux 8 | libreswan | 4.12-2.el8_10.7 | RLSA-2026:90492 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libreswan | 5.3.3-r0 | — |
| Alpine v3.23 | libreswan | 5.3.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libreswan | 4.12-3.amzn2023.0.4 | ALAS2023-2026-3253 |
| Amazon Linux 2 | libreswan | 3.25-4.8.amzn2.0.4 | ALAS2-2026-4021 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libreswan | 4.15-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | libreswan +1 | 5.3.3-1.0.1.el10_2 | ELSA-2026-89923 |
| Oracle Linux 9 | libreswan | 4.15-11.0.1.el9_8 | ELSA-2026-89748 |
| Oracle Linux 8 | libreswan | 4.12-2.0.1.el8_10.7 | ELSA-2026-90492 |
Advisories 14
- RLSA-2026:98088 Important: libreswan security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97878 Important: libreswan security update Rocky Linux Security Advisories · Nov 11, 2026
- WID-SEC-2026-4183 Red Hat Enterprise Linux Libreswan: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 10, 2026
- RLSA-2026:90492 Important: libreswan security update Rocky Linux Security Advisories · Oct 29, 2026
- ALSA-2026:89748 Important: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:89923 Important: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:90492 Important: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:89748 Important: libreswan security update Rocky Linux Security Advisories · Oct 27, 2026
- RLSA-2026:89923 Important: libreswan security update Rocky Linux Security Advisories · Oct 27, 2026
- ELSA-2026-90492 Important: libreswan security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 27, 2026
- ALAS2023-2026-3253 Important: libreswan security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2-2026-4021 Important: libreswan security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ELSA-2026-89923 Important: libreswan security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 26, 2026
- ELSA-2026-89748 Important: libreswan security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 26, 2026
References
- Libreswan Security Advisory CVE-2026-77207 vendor-advisory
- Libreswan CVE-2026-77207 Patches patch