CVE-2026-77205 The Libreswan Project CVE debrief

Who should care

Defenders managing Libreswan installations, especially those in FIPS mode, should assess their exposure and implement necessary patches or workarounds to prevent potential Denial of Service attacks.

Why it matters

CVE-2026-77205 is a Denial of Service vulnerability in Libreswan that can be exploited by sending bogus X.509 certificates, potentially locking out legitimate peers. Defenders should verify their Libreswan versions, assess exposure, and implement patches or workarounds.

• Potential lockout of legitimate peers due to bogus certificates
• Denial of Service (DoS) attacks through exploitation of this vulnerability
• Need for verification of Libreswan versions and exposure
• Priority on implementing vendor-provided patches or workarounds

Technical summary

The vulnerability in Libreswan, when in FIPS mode, allows an attacker to cause a Denial of Service by sending malformed X.509 certificates. This is due to the incorrect handling of certificate destruction in the add_decoded_cert() function, leading to potential lockout of legitimate peers. The incorrect fix for CVE-2026-14957 resulted in this vulnerability. The add_decoded_cert() function missed a call to CERT_DestroyCertificate(), causing real certificates with the same serial number as the bogus ones to be rejected. This can be abused to lock out legitimate peers from connecting.

Defensive priority

Defenders should prioritize verifying the versions of Libreswan in use and assessing exposure, especially for systems relying on certificate authentication.

Recommended defensive actions

• Verify Libreswan versions in use and assess exposure
• Implement patches or workarounds as provided by the vendor
• Monitor for suspicious certificate activity
• Review and update certificate management policies
• Conduct a thorough review of certificate validation processes
• Inventory all systems relying on Libreswan for certificate authentication
• Schedule regular security audits to detect potential vulnerabilities

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and references to vendor advisories and patches. The vulnerability in Libreswan, specifically when operating in FIPS mode, allows for a Denial of Service (DoS) attack by sending bogus X.509 certificates. This issue arises because the add_decoded_cert() function fails to call CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Consequently, legitimate peers can be locked out from connecting due to the rejection of real certificates with

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.