Null Pointer Dereference in Libreswan's IKEv2 State Machine
CVE-2026-77206

7.5HIGH

Key Information:

Vendor

The Libreswan Project

Status
Libreswan
Vendor
CVE Published:
13 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-77206?

Libreswan's IKEv2 state machine contains a null pointer dereference vulnerability within the EAP handling code, leading to a potential denial of service. When a malicious IKE_AUTH packet is sent, it can exploit inconsistencies in the IKEv2 state machine, resulting in crashing and restarting of the pluto daemon. Remarkably, this can occur without any configuration of EAP or authentication, as the vulnerable condition allows for an unauthorized trigger of the bug. While the bug does not enable remote code execution, it poses a significant risk by affecting service availability.

Affected Version(s)

libreswan 4.7 <= 5.3.2

libreswan 5.4

libreswan 5.3.3

References

https://libreswan.org/security/CVE-2026-77206/CVE-2026-77...
vendor-advisory
https://libreswan.org/security/CVE-2026-77206/
patch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Claude (Anthropic)
David Korczynski (ADA Logics Ltd)
.