Every CVE Search/ Get API key

CVE-2026-77206

IKEv2 pre-authentication Null Pointer Dereference in EAP code

7.5 HighFix available

CVE-2026-77206 is a high vulnerability (CVSS 7.5) in The Libreswan Project Libreswan, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in libreswan 5.3.3-r0.

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.66%Up 0.1 points since Oct 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

IKEv2 pre-authentication Null Pointer Dereference in EAP code

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2026-100748 7.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
EUVD-2026-100748
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-37xg-hvw9-pr82 7.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for...

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
GHSA-37xg-hvw9-pr82
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD 7.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2026-77206 7.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
ALPINE-CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVDEBIAN-CVE-2026-77206 7.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
DEBIAN-CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVRLSA-2026:89748 7.5

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)

  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)

  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89748
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:90492 7.5

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)

  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)

  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:90492
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-77206 7.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
UBUNTU-CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:89748 No score

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89748
Updated
2026-11-02
OSVALSA-2026:90492 No score

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:90492
Updated
2026-11-02
OSVAZL-108030 No score

CVE-2026-77206 affecting package libreswan 4.15-3

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
AZL-108030
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libreswan
Alpine:v3.23
 before 5.3.3-r0
5.3.3-r0
libreswan
Alpine:v3.24
 before 5.3.3-r0
5.3.3-r0
libreswan
AlmaLinux:9
 before 4.15-11.el9_8
4.15-11.el9_8
libreswan
AlmaLinux:8
 before 4.12-2.el8_10.7
4.12-2.el8_10.7
libreswan
Azure Linux:3
 through 4.15-3 None known
libreswan
Debian:12
 All versions, plus listed versions
4.10-24.10-2+deb12u14.11-14.12-14.12-2
Show 13 moreShow less
4.12-34.14-14.14-1.14.15-15.0~rc2-15.0~rc2-25.2-15.2-25.2-2.15.2-2.25.2-2.35.2-2.45.2-2.5
 None known
libreswan
Debian:13
 All versions, plus listed versions
5.2-2.25.2-2.35.2-2.45.2-2.5
 None known
libreswan
Debian:14
 All versions, plus listed versions
5.2-2.25.2-2.35.2-2.45.2-2.5
 None known
libreswan
Rocky Linux:9
 before 0:4.15-11.el9_8
0:4.15-11.el9_8
libreswan
Rocky Linux:8
 before 0:4.12-2.el8_10.7
0:4.12-2.el8_10.7
Show 6 moreShow less
Affected packages
PackageAffectedFixed
libreswan
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.20-7build13.21-23.22-13.22-23.22-33.22-43.23-13.23-4
 None known
libreswan
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.29-23.29-2build1
 None known
libreswan
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.32-3ubuntu3
 None known
libreswan
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.11-1ubuntu14.12-1ubuntu14.14-1ubuntu14.14-1ubuntu2
 None known
libreswan
Ubuntu:26.10
 All versions, plus listed versions
5.2-2.2ubuntu2
 None known
libreswan
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.2-2.2ubuntu15.2-2.2ubuntu2
 None known

History

History
WhenChangedSources
2026-11-03affected, aliases, referencesOSV
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open