{"id":"CVE-2026-77207","state":"PUBLISHED","title":"Null Pointer Dereference in PKCS#7 bundle with no certificates","description":"Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service.","publishedAt":"2026-10-13T21:28:19.219Z","updatedAt":"2026-10-16T15:31:53.986Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"libreswan"},"assigner":"libreswan","products":["The Libreswan Project libreswan"],"affected":[{"vendor":"The Libreswan Project","product":"libreswan","packageName":"libreswan","defaultStatus":"unaffected","versions":[{"version":"4.7","status":"affected","lessThanOrEqual":"5.3.2","versionType":"semver"},{"version":"5.4","status":"affected","lessThanOrEqual":"5.4","versionType":"semver"},{"version":"5.3.3","status":"unaffected","versionType":"semver"},{"version":"5.4.1","status":"unaffected","versionType":"semver"}],"collectionURL":"https://github.com/libreswan/libreswan","repo":"https://github.com/libreswan/libreswan","programRoutines":[{"name":"decode_cert_payloads"}]}],"references":["https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt","https://libreswan.org/security/CVE-2026-77207/"],"weaknesses":["CWE-476","CWE-252"],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/77xxx/CVE-2026-77207.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-77207","state":"PUBLISHED","datePublished":"2026-10-13T21:28:19.219Z","dateUpdated":"2026-10-16T15:31:53.986Z","assignerShortName":"libreswan","assignerOrgId":"d42dc95b-23f1-4e06-9076-20753a0fb0df","dateReserved":"2026-08-20T18:13:09.377Z"},"containers":{"cna":{"title":"Null Pointer Dereference in PKCS#7 bundle with no certificates","descriptions":[{"lang":"en","value":"Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. No remote code execution is possible. Continued exploitation can cause a denial of service."}],"affected":[{"vendor":"The Libreswan Project","product":"libreswan","packageName":"libreswan","defaultStatus":"unaffected","versions":[{"version":"4.7","status":"affected","lessThanOrEqual":"5.3.2","versionType":"semver"},{"version":"5.4","status":"affected","lessThanOrEqual":"5.4","versionType":"semver"},{"version":"5.3.3","status":"unaffected","versionType":"semver"},{"version":"5.4.1","status":"unaffected","versionType":"semver"}],"collectionURL":"https://github.com/libreswan/libreswan","repo":"https://github.com/libreswan/libreswan","programRoutines":[{"name":"decode_cert_payloads"}]}],"references":[{"url":"https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt","name":"Libreswan Security Advisory CVE-2026-77207","tags":["vendor-advisory"]},{"url":"https://libreswan.org/security/CVE-2026-77207/","name":"Libreswan CVE-2026-77207 Patches","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"other":{"type":"vendorSeverity","content":{"value":"MEDIUM","description":"Vendor-assessed severity: Medium. Exploitation does not require authentication, but the daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service."}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","lang":"en","type":"CWE","description":"CWE-476: Null Pointer Dereference"}]},{"descriptions":[{"cweId":"CWE-252","lang":"en","type":"CWE","description":"CWE-252: Unchecked Return Value"}]}],"providerMetadata":{"shortName":"libreswan","orgId":"d42dc95b-23f1-4e06-9076-20753a0fb0df","dateUpdated":"2026-10-13T21:28:19.219Z"},"impacts":[{"descriptions":[{"lang":"en","value":"Denial of service via null pointer dereference in PKCS#7 certificate handling when processing malicious IKE_AUTH packets"}]}],"workarounds":[{"lang":"en","value":"Apply the available patch or upgrade to a supported version. No configuration-based workaround is available."}],"solutions":[{"lang":"en","value":"Upgrade to libreswan 5.3.3 or 5.4.1 or later. Patches are available at https://libreswan.org/security/CVE-2026-77207/"}],"exploits":[{"lang":"en","value":"No known exploitation in the wild. Exploitation requires sending a malicious IKE CERT payload with a PKCS#7 SignedData containing a CRL but no certificates, and does not require peer authentication."}],"configurations":[{"lang":"en","value":"Any server or client that accepts IKEv2 connections with certificate-based authentication is vulnerable."}],"credits":[{"lang":"en","type":"tool","value":"Claude (Anthropic)"},{"lang":"en","type":"reporter","value":"David Korczynski (ADA Logics Ltd)"}],"source":{"discovery":"EXTERNAL","defects":["CVE-2026-77207"]},"timeline":[{"time":"2026-08-05T00:00:00.000Z","lang":"en","value":"Libreswan was notified of the issue via security@libreswan.org"},{"time":"2026-09-24T00:00:00.000Z","lang":"en","value":"Advanced notice given to supported customers and distributions"},{"time":"2026-10-05T00:00:00.000Z","lang":"en","value":"Public announcement and release of libreswan 5.3.3 and 5.4.1"}],"taxonomyMappings":[{"taxonomyName":"ATT&CK","taxonomyVersion":"15.1","taxonomyRelations":[{"taxonomyId":"T1499.004","relationshipName":"maps to","relationshipValue":"Application or System Exploitation (DoS)"}]}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-77207","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-16T15:14:50.209248Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T15:31:53.986Z"}}]}}}