CVE-2026-77206

Name of the Vulnerable Software and Affected Versions Libreswan (affected versions not specified)

Description A null pointer dereference exists in the IKEv2 state machine within the EAP handling code for authentication. Due to an inconsistency in the state machine code, a fall-through occurs where the system incorrectly dereferences the ike->sa.st eap variable while it is NULL. This issue can be triggered by any IKEv2 connection via a malicious IKE AUTH packet, regardless of whether EAP is configured, and does not require the peer to be authenticated. Exploitation leads to a crash and subsequent restart of the pluto daemon, which can result in a denial of service. Remote code execution is not possible.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.