Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-77205: Libreswan can be locked out by fake certificates

CVE-2026-77205 · published 5 days ago

Summary

The Libreswan VPN software, when running in FIPS mode, keeps malformed certificates in its cache and then blocks any legitimate certificates that share the same serial number. This lets an attacker send bogus certificates to prevent real peers from connecting until the service is restarted. Update Libreswan to a version that correctly removes malformed certificates, or disable FIPS mode if it is not required.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	the libreswan project	libreswan	<= 5.3.2
Ubuntu:18.04:LTS	canonical	libreswan	All versions

Original advisory text

Denial of Service via sending bogus X.509 certificates

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.

References

https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt Third Party Advisory
https://libreswan.org/security/CVE-2026-77205/ Third Party Advisory
https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt Third Party Advisory
https://ubuntu.com/security/CVE-2026-77205 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-77205 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

3.7 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-772Missing Release of Resource after Effective Lifetime

Timeline

Published13 Oct 2026

Updated17 Oct 2026

First seen13 Oct 2026

Sources

CVE-2026-77205 · NVD

CVE-2026-77205 · MITRE

UBUNTU-CVE-2026-77205 · OSV

Track software like this

Free during beta