Vulnerability-Lookup

CVE-2026-77206 (GCVE-0-2026-77206)

Vulnerability from cvelistv5 – Published: 2026-10-13 21:28 – Updated: 2026-10-16 15:31

Title

IKEv2 pre-authentication Null Pointer Dereference in EAP code

Summary

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:14 UTC

CWE

CWE-476 - Null Pointer Dereference

Assigner

libreswan CNA under the mitre root

CNA scorecard – unranked: 8 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://libreswan.org/security/CVE-2026-77206/CVE…	vendor-advisory
https://libreswan.org/security/CVE-2026-77206/	patch

Impacted products

1 product

Vendor	Product	Version	CPE status
The Libreswan Project	libreswan	Affected: 4.7 , ≤ 5.3.2 (semver) Affected: 5.4 , ≤ 5.4 (semver) Unaffected: 5.3.3 (semver) Unaffected: 5.4.1 (semver)	guessed

Credits

Claude (Anthropic) David Korczynski (ADA Logics Ltd)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77206",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:14:41.074180Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:31:54.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/libreswan/libreswan",
          "defaultStatus": "unaffected",
          "packageName": "libreswan",
          "product": "libreswan",
          "repo": "https://github.com/libreswan/libreswan",
          "vendor": "The Libreswan Project",
          "versions": [
            {
              "lessThanOrEqual": "5.3.2",
              "status": "affected",
              "version": "4.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4",
              "status": "affected",
              "version": "5.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.3.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Any server or client that accepts IKEv2 connections is vulnerable. The bug can be triggered even if EAP is not configured at all."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude (Anthropic)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "David Korczynski (ADA Logics Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libreswan\u0027s IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike-\u003esa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "No known exploitation in the wild. Exploitation requires sending a malicious IKE_AUTH packet and does not require peer authentication."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of service via null pointer dereference in EAP handling code when processing malicious IKE_AUTH packets"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "description": "Vendor-assessed severity: Medium. Exploitation does not require authentication, but the daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service.",
              "value": "MEDIUM"
            },
            "type": "vendorSeverity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476: Null Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T21:28:11.498Z",
        "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "shortName": "libreswan"
      },
      "references": [
        {
          "name": "Libreswan Security Advisory CVE-2026-77206",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
        },
        {
          "name": "Libreswan CVE-2026-77206 Patches",
          "tags": [
            "patch"
          ],
          "url": "https://libreswan.org/security/CVE-2026-77206/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Note that EAP was not functional in libreswan 5.3. If you need EAP support, use 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77206/"
        }
      ],
      "source": {
        "defects": [
          "CVE-2026-77206"
        ],
        "discovery": "EXTERNAL"
      },
      "taxonomyMappings": [
        {
          "taxonomyName": "ATT\u0026CK",
          "taxonomyRelations": [
            {
              "relationshipName": "maps to",
              "relationshipValue": "Application or System Exploitation (DoS)",
              "taxonomyId": "T1499.004"
            }
          ],
          "taxonomyVersion": "15.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-05T00:00:00.000Z",
          "value": "Libreswan was notified of the issue via security@libreswan.org"
        },
        {
          "lang": "en",
          "time": "2026-09-24T00:00:00.000Z",
          "value": "Advanced notice given to supported customers and distributions"
        },
        {
          "lang": "en",
          "time": "2026-10-05T00:00:00.000Z",
          "value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"
        }
      ],
      "title": "IKEv2 pre-authentication Null Pointer Dereference in EAP code",
      "workarounds": [
        {
          "lang": "en",
          "value": "Apply the available patch or upgrade to a supported version. No configuration-based workaround is available."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
    "assignerShortName": "libreswan",
    "cveId": "CVE-2026-77206",
    "datePublished": "2026-10-13T21:28:11.498Z",
    "dateReserved": "2026-08-20T18:13:09.377Z",
    "dateUpdated": "2026-10-16T15:31:54.304Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77206",
      "date": "2026-11-04",
      "epss": "0.00658",
      "percentile": "0.51624"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-16T01:52:05.000Z",
      "cve": "CVE-2026-77206",
      "id": "msrc_CVE-2026-77206",
      "initial_release_date": "2026-10-15T01:08:36.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "IKEv2 pre-authentication Null Pointer Dereference in EAP code",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-77206.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://github.com/libreswan/libreswan",
                "defaultStatus": "unaffected",
                "packageName": "libreswan",
                "product": "libreswan",
                "repo": "https://github.com/libreswan/libreswan",
                "vendor": "The Libreswan Project",
                "versions": [
                  {
                    "lessThanOrEqual": "5.3.2",
                    "status": "affected",
                    "version": "4.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4",
                    "status": "affected",
                    "version": "5.4",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "5.3.3",
                    "versionType": "semver"
                  },
                  {
                    "status": "unaffected",
                    "version": "5.4.1",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Libreswan\u0027s IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike-\u003esa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service."
          }
        ],
        "id": "CVE-2026-77206",
        "lastModified": "2026-10-16T19:55:59.740",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-77206",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:14:41.074180Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-13T22:18:24.727",
        "references": [
          {
            "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
            "url": "https://libreswan.org/security/CVE-2026-77206/"
          },
          {
            "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
            "url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
          }
        ],
        "sourceIdentifier": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-30T15:13:26+00:00",
      "cve": "CVE-2026-77206",
      "id": "CVE-2026-77206",
      "initial_release_date": "2026-10-05T00:00:00+00:00",
      "product_status:fixed": "26",
      "product_status:known_affected": "9",
      "product_status:known_not_affected": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77206.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-27T01:07:39Z",
      "cve": "CVE-2026-77206",
      "id": "CVE-2026-77206",
      "initial_release_date": "2026-10-27T01:07:39Z",
      "product_status:recommended": "1",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-77206",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-77206.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-77206",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-16T15:14:41.074180Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T15:30:06.811Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com/libreswan/libreswan",
              "defaultStatus": "unaffected",
              "packageName": "libreswan",
              "product": "libreswan",
              "repo": "https://github.com/libreswan/libreswan",
              "vendor": "The Libreswan Project",
              "versions": [
                {
                  "lessThanOrEqual": "5.3.2",
                  "status": "affected",
                  "version": "4.7",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4",
                  "status": "affected",
                  "version": "5.4",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "5.3.3",
                  "versionType": "semver"
                },
                {
                  "status": "unaffected",
                  "version": "5.4.1",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "value": "Any server or client that accepts IKEv2 connections is vulnerable. The bug can be triggered even if EAP is not configured at all."
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "tool",
              "value": "Claude (Anthropic)"
            },
            {
              "lang": "en",
              "type": "reporter",
              "value": "David Korczynski (ADA Logics Ltd)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Libreswan\u0027s IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike-\u003esa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "value": "No known exploitation in the wild. Exploitation requires sending a malicious IKE_AUTH packet and does not require peer authentication."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "Denial of service via null pointer dereference in EAP handling code when processing malicious IKE_AUTH packets"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "other": {
                "content": {
                  "description": "Vendor-assessed severity: Medium. Exploitation does not require authentication, but the daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service.",
                  "value": "MEDIUM"
                },
                "type": "vendorSeverity"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-476",
                  "description": "CWE-476: Null Pointer Dereference",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-13T21:28:11.498Z",
            "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
            "shortName": "libreswan"
          },
          "references": [
            {
              "name": "Libreswan Security Advisory CVE-2026-77206",
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
            },
            {
              "name": "Libreswan CVE-2026-77206 Patches",
              "tags": [
                "patch"
              ],
              "url": "https://libreswan.org/security/CVE-2026-77206/"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to libreswan 5.3.3 or 5.4.1 or later. Note that EAP was not functional in libreswan 5.3. If you need EAP support, use 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77206/"
            }
          ],
          "source": {
            "defects": [
              "CVE-2026-77206"
            ],
            "discovery": "EXTERNAL"
          },
          "taxonomyMappings": [
            {
              "taxonomyName": "ATT\u0026CK",
              "taxonomyRelations": [
                {
                  "relationshipName": "maps to",
                  "relationshipValue": "Application or System Exploitation (DoS)",
                  "taxonomyId": "T1499.004"
                }
              ],
              "taxonomyVersion": "15.1"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-08-05T00:00:00.000Z",
              "value": "Libreswan was notified of the issue via security@libreswan.org"
            },
            {
              "lang": "en",
              "time": "2026-09-24T00:00:00.000Z",
              "value": "Advanced notice given to supported customers and distributions"
            },
            {
              "lang": "en",
              "time": "2026-10-05T00:00:00.000Z",
              "value": "Public announcement and release of libreswan 5.3.3 and 5.4.1"
            }
          ],
          "title": "IKEv2 pre-authentication Null Pointer Dereference in EAP code",
          "workarounds": [
            {
              "lang": "en",
              "value": "Apply the available patch or upgrade to a supported version. No configuration-based workaround is available."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "assignerShortName": "libreswan",
        "cveId": "CVE-2026-77206",
        "datePublished": "2026-10-13T21:28:11.498Z",
        "dateReserved": "2026-08-20T18:13:09.377Z",
        "dateUpdated": "2026-10-16T15:31:54.304Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

ALSA-2026:89748 (CVE-2026-77206)

Vulnerability from osv_almalinux – Published: 2026-10-26 00:00 – Updated: 2026-10-26 20:31 – Source website

Summary

Important: libreswan security update

Details

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:89748	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-77206	REPORT
	https://access.redhat.com/security/cve/CVE-2026-77207	REPORT
	https://access.redhat.com/security/cve/CVE-2026-94453	REPORT
	https://bugzilla.redhat.com/2550254	REPORT
	https://bugzilla.redhat.com/2550256	REPORT
	https://bugzilla.redhat.com/2550258	REPORT
	https://errata.almalinux.org/9/ALSA-2026-89748.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "libreswan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.15-11.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).  \n\nSecurity Fix(es):  \n\n  * libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)\n  * libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)\n  * libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:89748",
  "modified": "2026-10-26T20:31:09Z",
  "published": "2026-10-26T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:89748"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-77206"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-77207"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-94453"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550254"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550256"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550258"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-89748.html"
    }
  ],
  "related": [
    "CVE-2026-77206",
    "CVE-2026-77207",
    "CVE-2026-94453"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: libreswan security update",
  "upstream": [
    "CVE-2026-77206",
    "CVE-2026-77207",
    "CVE-2026-94453"
  ]
}

ALSA-2026:90492 (CVE-2026-77206)

Vulnerability from osv_almalinux – Published: 2026-10-26 00:00 – Updated: 2026-10-26 21:41 – Source website

Summary

Important: libreswan security update

Details

Security Fix(es):

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:90492	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-77206	REPORT
	https://access.redhat.com/security/cve/CVE-2026-77207	REPORT
	https://access.redhat.com/security/cve/CVE-2026-94453	REPORT
	https://bugzilla.redhat.com/2550254	REPORT
	https://bugzilla.redhat.com/2550256	REPORT
	https://bugzilla.redhat.com/2550258	REPORT
	https://errata.almalinux.org/8/ALSA-2026-90492.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libreswan"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.12-2.el8_10.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).  \n\nSecurity Fix(es):  \n\n  * libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)\n  * libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)\n  * libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:90492",
  "modified": "2026-10-26T21:41:23Z",
  "published": "2026-10-26T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:90492"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-77206"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-77207"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-94453"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550254"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550256"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550258"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2026-90492.html"
    }
  ],
  "related": [
    "CVE-2026-77206",
    "CVE-2026-77207",
    "CVE-2026-94453"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: libreswan security update",
  "upstream": [
    "CVE-2026-77206",
    "CVE-2026-77207",
    "CVE-2026-94453"
  ]
}

FKIE_CVE-2026-77206

Vulnerability from fkie_nvd - Published: 2026-10-13 22:18 - Updated: 2026-10-16 19:55

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	d42dc95b-23f1-4e06-9076-20753a0fb0df	https://libreswan.org/security/CVE-2026-77206/
	d42dc95b-23f1-4e06-9076-20753a0fb0df	https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/libreswan/libreswan",
          "defaultStatus": "unaffected",
          "packageName": "libreswan",
          "product": "libreswan",
          "repo": "https://github.com/libreswan/libreswan",
          "vendor": "The Libreswan Project",
          "versions": [
            {
              "lessThanOrEqual": "5.3.2",
              "status": "affected",
              "version": "4.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4",
              "status": "affected",
              "version": "5.4",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.3.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Libreswan\u0027s IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike-\u003esa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service."
    }
  ],
  "id": "CVE-2026-77206",
  "lastModified": "2026-10-16T19:55:59.740",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77206",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-16T15:14:41.074180Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-13T22:18:24.727",
  "references": [
    {
      "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
      "url": "https://libreswan.org/security/CVE-2026-77206/"
    },
    {
      "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
      "url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
    }
  ],
  "sourceIdentifier": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ],
      "source": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
      "type": "Secondary"
    }
  ]
}

GHSA-37XG-HVW9-PR82

Vulnerability from github – Published: 2026-10-14 00:31 – Updated: 2026-10-14 00:31

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-77206"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-13T22:18:24Z",
    "severity": "HIGH"
  },
  "details": "Libreswan\u0027s IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike-\u003esa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.",
  "id": "GHSA-37xg-hvw9-pr82",
  "modified": "2026-10-14T00:31:47Z",
  "published": "2026-10-14T00:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77206"
    },
    {
      "type": "WEB",
      "url": "https://libreswan.org/security/CVE-2026-77206"
    },
    {
      "type": "WEB",
      "url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-77206

Vulnerability from csaf_microsoft - Published: 2026-10-15 01:08 - Updated: 2026-10-16 01:52

Summary

IKEv2 pre-authentication Null Pointer Dereference in EAP code

Scope

1 vulnerability in this advisory, including CVE-2026-77206.

CVE-2026-77206

Known not affected: 1 product

Open the full advisory

RHSA-2026:89748

Vulnerability from csaf_redhat - Published: 2026-10-26 02:43 - Updated: 2026-10-30 15:13

Summary

Red Hat Security Advisory: libreswan security update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2026-77206.

CVE-2026-77206

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 13 products

https://access.redhat.com/errata/RHSA-2026:89748

Open the full advisory

RHSA-2026:90492

Vulnerability from csaf_redhat - Published: 2026-10-26 21:12 - Updated: 2026-10-30 15:13

Summary

Red Hat Security Advisory: libreswan security update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2026-77206.

CVE-2026-77206

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 13 products

https://access.redhat.com/errata/RHSA-2026:90492

Open the full advisory

RLSA-2026:89748 (CVE-2026-77206)

Vulnerability from osv_rocky – Published: 2026-10-27 12:04 – Updated: 2026-11-05 00:12 – Source website

Summary

Important: libreswan security update

Details

Security Fix(es):

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:89748	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2550254	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2550256	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2550258	REPORT
	https://access.redhat.com/errata/RHSA-2026:89748	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "libreswan",
        "purl": "pkg:rpm/rocky-linux/libreswan?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "AppStream"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.15-11.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:89748"
  },
  "details": "Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)\n\n* libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)\n\n* libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:89748",
  "modified": "2026-11-05T00:12:43.018542Z",
  "published": "2026-10-27T12:04:29.081572Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:89748"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550254"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550256"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550258"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:89748"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: libreswan security update",
  "upstream": [
    "CVE-2026-77206",
    "CVE-2026-77207",
    "CVE-2026-94453"
  ]
}

RLSA-2026:90492 (CVE-2026-77206)

Vulnerability from osv_rocky – Published: 2026-10-29 12:01 – Updated: 2026-11-05 00:12 – Source website

Summary

Important: libreswan security update

Details

Security Fix(es):

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:90492	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2550254	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2550256	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2550258	REPORT
	https://access.redhat.com/errata/RHSA-2026:90492	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "libreswan",
        "purl": "pkg:rpm/rocky-linux/libreswan?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "AppStream"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.12-2.el8_10.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:90492"
  },
  "details": "Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)\n\n* libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)\n\n* libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:90492",
  "modified": "2026-11-05T00:12:24.816526Z",
  "published": "2026-10-29T12:01:16.697685Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:90492"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550254"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550256"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550258"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:90492"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: libreswan security update",
  "upstream": [
    "CVE-2026-77206",
    "CVE-2026-77207",
    "CVE-2026-94453"
  ]
}

UBUNTU-CVE-2026-77206 (CVE-2026-77206)

Vulnerability from osv_ubuntu – Published: 2026-10-13 22:18 – Updated: 2026-10-13 22:18 – Source website

Details

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-77206	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-77206	REPORT
	https://libreswan.org/security/CVE-2026-77206/	REPORT
	https://libreswan.org/security/CVE-2026-77206/CVE…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libreswan",
            "binary_version": "3.23-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libreswan",
        "purl": "pkg:deb/ubuntu/libreswan@3.23-4?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.20-7build1",
        "3.21-2",
        "3.22-1",
        "3.22-2",
        "3.22-3",
        "3.22-4",
        "3.23-1",
        "3.23-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libreswan",
            "binary_version": "3.29-2build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libreswan",
        "purl": "pkg:deb/ubuntu/libreswan@3.29-2build1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.29-2",
        "3.29-2build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libreswan",
            "binary_version": "3.32-3ubuntu3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libreswan",
        "purl": "pkg:deb/ubuntu/libreswan@3.32-3ubuntu3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.32-3ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libreswan",
            "binary_version": "4.14-1ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libreswan",
        "purl": "pkg:deb/ubuntu/libreswan@4.14-1ubuntu2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.11-1ubuntu1",
        "4.12-1ubuntu1",
        "4.14-1ubuntu1",
        "4.14-1ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libreswan",
            "binary_version": "5.2-2.2ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "libreswan",
        "purl": "pkg:deb/ubuntu/libreswan@5.2-2.2ubuntu2?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.2-2.2ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libreswan",
            "binary_version": "5.2-2.2ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libreswan",
        "purl": "pkg:deb/ubuntu/libreswan@5.2-2.2ubuntu2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "5.2-2.2ubuntu1",
        "5.2-2.2ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "Libreswan\u0027s IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike-\u003esa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.",
  "id": "UBUNTU-CVE-2026-77206",
  "modified": "2026-10-13T22:18:00Z",
  "published": "2026-10-13T22:18:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-77206"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77206"
    },
    {
      "type": "REPORT",
      "url": "https://libreswan.org/security/CVE-2026-77206/"
    },
    {
      "type": "REPORT",
      "url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-77206"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77206 (GCVE-0-2026-77206)

ALSA-2026:89748 (CVE-2026-77206)

ALSA-2026:90492 (CVE-2026-77206)

FKIE_CVE-2026-77206

GHSA-37XG-HVW9-PR82

MSRC_CVE-2026-77206

RHSA-2026:89748

RHSA-2026:90492

RLSA-2026:89748 (CVE-2026-77206)

RLSA-2026:90492 (CVE-2026-77206)

UBUNTU-CVE-2026-77206 (CVE-2026-77206)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour