Certificate Handling Vulnerability in Libreswan by Xelerance
CVE-2026-77205
Key Information:
- Vendor
The Libreswan Project
- Status
- Vendor
- CVE Published:
- 13 October 2026
Badges
What is CVE-2026-77205?
Libreswan, operating in FIPS mode, presents a vulnerability that affects the handling of malformed certificates. When improperly formed certificates are received, they are rejected but remain in the NSS cache. This oversight can lead to a situation where legitimate certificates sharing the same serial number are also rejected, potentially locking out authorized peers from establishing secure connections. The flaw stems from the add_decoded_cert() function, which failed to invoke CERT_DestroyCertificate() due to a previous incorrect resolution. Attackers can exploit this issue by sending bogus certificates with new serial numbers, creating an obstacle for legitimate certificates until the service is restarted.
Affected Version(s)
libreswan 5.3 <= 5.3.2
libreswan 5.3.3