CVE-2026-77207 Overview
Libreswan contains a null pointer dereference in the PKCS#7 handling code used during Internet Key Exchange (IKE) certificate authentication. The flaw lives in the decoding path for CERT_PKCS7_WRAPPED_X509 payloads, where two Network Security Services (NSS) APIs return inconsistent results for a SignedData structure that carries a Certificate Revocation List (CRL) but no certificates. An unauthenticated attacker can send a crafted IKE_AUTH packet to crash the daemon. Repeated exploitation causes a sustained denial of service on affected VPN gateways. Remote code execution is not possible [CWE-252].
Critical Impact
An unauthenticated remote attacker can crash the Libreswan IKE daemon by sending a single malformed IKE_AUTH packet, enabling a persistent denial of service against IPsec VPN endpoints.
Affected Products
- Libreswan IPsec implementation (versions supporting IKE certificate authentication with PKCS#7-wrapped X.509 payloads)
- Linux distributions bundling vulnerable Libreswan builds for IPsec VPN services
- IKEv1 and IKEv2 deployments that accept CERT_PKCS7_WRAPPED_X509 certificate payloads
Discovery Timeline
- 2026-10-13 - CVE CVE-2026-77207 published to the National Vulnerability Database (NVD)
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-77207
Vulnerability Analysis
Libreswan processes IKE CERT payloads of type CERT_PKCS7_WRAPPED_X509 during peer authentication. Before iterating the embedded certificates, the code calls SEC_PKCS7ContainsCertsOrCrls() as a guard. If that check succeeds, Libreswan invokes SEC_PKCS7GetCertificateList() and dereferences the returned pointer.
The two NSS functions disagree when a SignedData structure contains a CRL but no certificates. SEC_PKCS7ContainsCertsOrCrls() returns PR_TRUE because a CRL is present. SEC_PKCS7GetCertificateList() returns NULL because no certificates exist. Libreswan dereferences the NULL pointer and the IKE daemon (pluto) crashes.
The crash occurs before peer authentication completes, so the attacker does not need valid credentials. Service managers typically restart pluto, but repeated malicious packets keep the daemon in a crash loop. All active IPsec tunnels drop during each restart, interrupting site-to-site VPNs and remote access sessions.
Root Cause
The root cause is an unchecked return value [CWE-252] combined with inconsistent semantics across two NSS helper APIs. The guard function and the data-access function use different definitions of "contains certificates," and Libreswan assumed the two were equivalent.
Attack Vector
An attacker reachable over the network sends a crafted IKE_AUTH message containing a CERT payload of type CERT_PKCS7_WRAPPED_X509. The PKCS#7 blob is a SignedData structure that includes a CRL but omits any certificates. The attack requires no authentication, no user interaction, and no prior session state beyond initiating the IKE handshake.
For technical specifics, refer to the Libreswan CVE-2026-77207 Advisory and the Libreswan CVE-2026-77207 Detailed Report.
Detection Methods for CVE-2026-77207
Indicators of Compromise
- Repeated pluto process crashes or restarts logged by systemd or the init system on IPsec gateways.
- IKE log entries referencing CERT_PKCS7_WRAPPED_X509 payload processing immediately before daemon termination.
- Core dumps generated by Libreswan with stack frames in SEC_PKCS7GetCertificateList or Libreswan's PKCS#7 decoding path.
- Spikes in IKE_AUTH messages from unexpected source addresses on UDP ports 500 and 4500.
Detection Strategies
- Monitor service manager logs for pluto.service restart events and correlate with inbound IKE traffic.
- Alert on sudden drops in established IPsec Security Associations (SAs) across VPN concentrators.
- Inspect IKE packet captures for CERT payloads of type 4 (CERT_PKCS7_WRAPPED_X509) originating from untrusted peers.
Monitoring Recommendations
- Centralize pluto syslog output and track crash frequency over rolling windows.
- Instrument VPN gateway health checks that report tunnel count and daemon uptime to the SOC.
- Rate-limit or geo-filter inbound IKE traffic at the perimeter and alert on anomalies.
How to Mitigate CVE-2026-77207
Immediate Actions Required
- Apply the Libreswan security update referenced in the vendor advisory as soon as it is available for your distribution.
- Restrict inbound UDP 500 and UDP 4500 to known peer IP addresses using firewall rules.
- Monitor pluto restart counters and open an incident if the daemon crashes repeatedly within a short window.
Patch Information
Consult the Libreswan CVE-2026-77207 Advisory for fixed version numbers and distribution-specific package updates. Linux vendors such as Red Hat, Debian, Ubuntu, and SUSE typically backport Libreswan security fixes, so verify the installed package version matches or exceeds the patched release noted by your distribution.
Workarounds
- Where feasible, disable PKCS#7-wrapped X.509 certificate payloads and require raw X.509 certificates for IKE authentication.
- Place the VPN gateway behind an IKE-aware firewall or load balancer that validates CERT payload structure before forwarding.
- Configure automatic restart with backoff for pluto.service so a crash loop does not consume host resources while mitigations are deployed.
# Example: restrict IKE to known peers via nftables
nft add rule inet filter input udp dport {500, 4500} ip saddr != { 203.0.113.10, 198.51.100.25 } drop
# Example: verify installed Libreswan version
ipsec --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
