{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-77207","assignerOrgId":"d42dc95b-23f1-4e06-9076-20753a0fb0df","state":"PUBLISHED","assignerShortName":"libreswan","dateReserved":"2026-08-20T18:13:09.377Z","datePublished":"2026-10-13T21:28:19.219Z","dateUpdated":"2026-10-13T21:28:19.219Z"},"containers":{"cna":{"providerMetadata":{"orgId":"d42dc95b-23f1-4e06-9076-20753a0fb0df","shortName":"libreswan","dateUpdated":"2026-10-13T21:28:19.219Z"},"title":"Null Pointer Dereference in PKCS#7 bundle with no certificates","descriptions":[{"lang":"en","value":"Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service."}],"affected":[{"vendor":"The Libreswan Project","product":"libreswan","packageName":"libreswan","collectionURL":"https://github.com/libreswan/libreswan","repo":"https://github.com/libreswan/libreswan","versions":[{"version":"4.7","status":"affected","lessThanOrEqual":"5.3.2","versionType":"semver"},{"version":"5.4","status":"affected","lessThanOrEqual":"5.4","versionType":"semver"},{"version":"5.3.3","status":"unaffected","versionType":"semver"},{"version":"5.4.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","programRoutines":[{"name":"decode_cert_payloads"}]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-476","description":"CWE-476: Null Pointer Dereference"}]},{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-252","description":"CWE-252: Unchecked Return Value"}]}],"impacts":[{"descriptions":[{"lang":"en","value":"Denial of service via null pointer dereference in PKCS#7 certificate handling when processing malicious IKE_AUTH packets"}]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"other":{"type":"vendorSeverity","content":{"value":"MEDIUM","description":"Vendor-assessed severity: Medium. Exploitation does not require authentication, but the daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service."}}}],"workarounds":[{"lang":"en","value":"Apply the available patch or upgrade to a supported version. No configuration-based workaround is available."}],"solutions":[{"lang":"en","value":"Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77207/"}],"exploits":[{"lang":"en","value":"No known exploitation in the wild. Exploitation requires sending a malicious IKE CERT payload with a PKCS#7 SignedData containing a CRL but no certificates, and does not require peer authentication."}],"configurations":[{"lang":"en","value":"Any server or client that accepts IKEv2 connections with certificate-based authentication is vulnerable."}],"credits":[{"lang":"en","type":"tool","value":"Claude (Anthropic)"},{"lang":"en","type":"reporter","value":"David Korczynski (ADA Logics Ltd)"}],"source":{"discovery":"EXTERNAL","defects":["CVE-2026-77207"]},"references":[{"name":"Libreswan Security Advisory CVE-2026-77207","url":"https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt","tags":["vendor-advisory"]},{"name":"Libreswan CVE-2026-77207 Patches","url":"https://libreswan.org/security/CVE-2026-77207/","tags":["patch"]}],"timeline":[{"time":"2026-08-05T00:00:00.000Z","lang":"en","value":"Libreswan was notified of the issue via security@libreswan.org"},{"time":"2026-09-24T00:00:00.000Z","lang":"en","value":"Advanced notice given to supported customers and distributions"},{"time":"2026-10-05T00:00:00.000Z","lang":"en","value":"Public announcement and release of libreswan 5.3.3 and 5.4.1"}],"taxonomyMappings":[{"taxonomyName":"ATT&CK","taxonomyVersion":"15.1","taxonomyRelations":[{"taxonomyId":"T1499.004","relationshipName":"maps to","relationshipValue":"Application or System Exploitation (DoS)"}]}],"x_generator":{"engine":"cvelib 1.8.0"}}}}