CVE-2026-77207

Name of the Vulnerable Software and Affected Versions Libreswan (affected versions not specified)

Description A null pointer dereference exists in the PKCS#7 handling code used for IKE certificate authentication. The issue occurs when decoding an IKE CERT payload of type CERT PKCS7 WRAPPED X509. The software uses SEC PKCS7ContainsCertsOrCrls() to validate the PKCS#7 blob and subsequently uses SEC PKCS7GetCertificateList() to iterate the certificate list. A discrepancy between these two NSS APIs allows a SignedData object containing a CRL (Certificate Revocation List) but no certificates to pass the initial guard, while the subsequent list retrieval returns NULL. This leads to a null pointer dereference, causing the system to crash and restart. An unauthenticated peer can trigger this behavior by sending a malicious IKE AUTH packet, potentially resulting in a denial of service through repeated exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.