Every CVESearch/Get API key

CVE-2026-77206

IKEv2 pre-authentication Null Pointer Dereference in EAP code

7.5 HighFix available

CVE-2026-77206 is a high vulnerability (CVSS 7.5) in The Libreswan Project Libreswan, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in libreswan 5.3.3-r0.

Severity
7.5 HighCVSS 3.1, CVE List
Exploit chance
0.66%EPSS, 52nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
5.3.3-r0libreswan +34 more

Description

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.66%Up 0.1 points since Oct 14, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libreswan
Alpine:v3.23
before 5.3.3-r0
5.3.3-r0
libreswan
Alpine:v3.24
before 5.3.3-r0
5.3.3-r0
libreswan
AlmaLinux:9
From an advisory covering 3 CVEs
before 4.15-11.el9_8
4.15-11.el9_8
libreswan
AlmaLinux:8
From an advisory covering 3 CVEs
before 4.12-2.el8_10.7
4.12-2.el8_10.7
libreswan
Azure Linux:3
through 4.15-3None known
libreswan
Debian:12
All versions, plus listed versions
4.10-24.10-2+deb12u14.11-14.12-14.12-2
Show 13 moreShow less
4.12-34.14-14.14-1.14.15-15.0~rc2-15.0~rc2-25.2-15.2-25.2-2.15.2-2.25.2-2.35.2-2.45.2-2.5
None known
libreswan
Debian:13
All versions, plus listed versions
5.2-2.25.2-2.35.2-2.45.2-2.5
None known
libreswan
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
before 0:4.15-11.el9_8
0:4.15-11.el9_8
libreswan-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
before 0:4.15-11.el9_8
0:4.15-11.el9_8
libreswan-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
before 0:4.15-11.el9_8
0:4.15-11.el9_8
Show 25 moreShow less
Affected packages
PackageAffectedFixed
libreswan
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
before 0:4.12-2.el8_10.7
0:4.12-2.el8_10.7
libreswan-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
before 0:4.12-2.el8_10.7
0:4.12-2.el8_10.7
libreswan-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 3 CVEs
before 0:4.12-2.el8_10.7
0:4.12-2.el8_10.7
libreswan
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
before 0:4.15-11.el9_9
0:4.15-11.el9_9
libreswan-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
before 0:4.15-11.el9_9
0:4.15-11.el9_9
libreswan-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 3 CVEs
before 0:4.15-11.el9_9
0:4.15-11.el9_9
libreswan
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 4 CVEs
before 0:5.3.3-3.el9fdp
0:5.3.3-3.el9fdp
libreswan-debuginfo
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 4 CVEs
before 0:5.3.3-3.el9fdp
0:5.3.3-3.el9fdp
libreswan-debugsource
Red Hat:enterprise_linux:9::fastdatapath
From an advisory covering 4 CVEs
before 0:5.3.3-3.el9fdp
0:5.3.3-3.el9fdp
libreswan
Red Hat:enterprise_linux:10.3
From an advisory covering 3 CVEs
before 0:5.4.1-1.el10_3
0:5.4.1-1.el10_3
libreswan-debugsource
Red Hat:enterprise_linux:10.3
From an advisory covering 3 CVEs
before 0:5.4.1-1.el10_3
0:5.4.1-1.el10_3
libreswan-minimal
Red Hat:enterprise_linux:10.3
From an advisory covering 3 CVEs
before 0:5.4.1-1.el10_3
0:5.4.1-1.el10_3
libreswan-minimal-debuginfo
Red Hat:enterprise_linux:10.3
From an advisory covering 3 CVEs
before 0:5.4.1-1.el10_3
0:5.4.1-1.el10_3
libreswan
Rocky Linux:9
From an advisory covering 3 CVEs
before 0:4.15-11.el9_8
0:4.15-11.el9_8
libreswan
Rocky Linux:8
From an advisory covering 3 CVEs
before 0:4.12-2.el8_10.7
0:4.12-2.el8_10.7
libreswan-minimal
Rocky Linux:10
From an advisory covering 3 CVEs
before 0:5.4.1-1.el10_3
0:5.4.1-1.el10_3
libreswan-debugsource
Rocky Linux:10
From an advisory covering 3 CVEs
before 0:5.4.1-1.el10_3
0:5.4.1-1.el10_3
libreswan-minimal-debuginfo
Rocky Linux:10
From an advisory covering 3 CVEs
before 0:5.4.1-1.el10_3
0:5.4.1-1.el10_3
libreswan
Rocky Linux:10
From an advisory covering 3 CVEs
before 0:5.4.1-1.el10_3
0:5.4.1-1.el10_3
libreswan
Ubuntu:18.04:LTS
All versions, plus listed versions
3.20-7build13.21-23.22-13.22-23.22-33.22-43.23-13.23-4
None known
libreswan
Ubuntu:20.04:LTS
All versions, plus listed versions
3.29-23.29-2build1
None known
libreswan
Ubuntu:22.04:LTS
All versions, plus listed versions
3.32-3ubuntu3
None known
libreswan
Ubuntu:24.04:LTS
All versions, plus listed versions
4.11-1ubuntu14.12-1ubuntu14.14-1ubuntu14.14-1ubuntu2
None known
libreswan
Ubuntu:26.10
All versions, plus listed versions
5.2-2.2ubuntu2
None known
libreswan
Ubuntu:26.04:LTS
All versions, plus listed versions
5.2-2.2ubuntu15.2-2.2ubuntu2
None known

What each source reports

CVE List Score used7.5

IKEv2 pre-authentication Null Pointer Dereference in EAP code

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2026-1007487.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
EUVD-2026-100748
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-37xg-hvw9-pr827.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for...

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
GHSA-37xg-hvw9-pr82
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
NVD7.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2026-772067.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
ALPINE-CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVDEBIAN-CVE-2026-772067.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
DEBIAN-CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
Show 13 moreShow less
OSVRHSA-2026:897487.5

Red Hat Security Advisory: libreswan security update

Record
RHSA-2026:89748
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:904927.5

Red Hat Security Advisory: libreswan security update

Record
RHSA-2026:90492
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:978787.5

Red Hat Security Advisory: libreswan security update

Record
RHSA-2026:97878
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:980467.5

Red Hat Security Advisory: libreswan security, bug fix, and enhancement update

Record
RHSA-2026:98046
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRHSA-2026:980887.5

Red Hat Security Advisory: libreswan security update

Record
RHSA-2026:98088
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVRLSA-2026:897487.5

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)

  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)

  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:89748
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:904927.5

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)

  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)

  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:90492
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:978787.5

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)

  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)

  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:97878
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-11
OSVRLSA-2026:980887.5

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)

  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)

  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:98088
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-13
OSVUBUNTU-CVE-2026-772067.5

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
UBUNTU-CVE-2026-77206
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:89748No score

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:89748
Updated
2026-11-02
OSVALSA-2026:90492No score

Important: libreswan security update

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:90492
Updated
2026-11-02
OSVAZL-108030No score

CVE-2026-77206 affecting package libreswan 4.15-3

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Record
AZL-108030
Updated
2026-11-02

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected
affected, factsOSV
affected, aliases, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 47 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open