CVE catalog

CVE-2026-77206

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be trigge

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.66% · Oct 25, 2026

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibreswansid5.2-2.5vulnerable
Debianlibreswanforky5.2-2.5vulnerable
Debianlibreswantrixie5.2-2.2vulnerable
Debianlibreswanbookworm4.10-2+deb12u1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibreswansourcesid(unfixed)not yet assignedNot reported[1150899]
Debianlibreswansourceforky(unfixed)not yet assignedNot reported[1150899]
Debianlibreswansourcetrixie(unfixed)not yet assignedNot reported[1150899]
Debianlibreswansourcebookworm(unfixed)not yet assignedNot reported[1150899]

[Debian bug #1150899]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libreswan]Affected
    Details (2)

    • 4.10-2+deb12u1 · amd64 · bookworm

      Affected

      nvd · libreswan · debian · bookworm; nvd · libreswan · debian · 12

    • 4.10-2+deb12u1 · arm64 · bookworm

      Affected

      nvd · libreswan · debian · bookworm; nvd · libreswan · debian · 12

[Debian 13 (Trixie)]

  • [libreswan]Affected
    Details (2)

    • 5.2-2.2 · amd64 · trixie

      Affected

      nvd · libreswan · debian · 13

    • 5.2-2.2 · arm64 · trixie

      Affected

      nvd · libreswan · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]