Null Pointer Dereference Vulnerability in Libreswan: Crash Risk from Malicious IKE_AUTH Packets
Summary
DEBIAN-CVE-2026-77207: Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. Affects libreswan versions 4.10-2 – 5.2-2.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Libreswan is an open-source implementation of the Internet Key Exchange (IKE) and IPsec protocols, providing secure communication over the internet. It is widely used for establishing Virtual Private Networks (VPNs) and ensuring data integrity and confidentiality. The package is known for its robust security features, but it is susceptible to vulnerabilities that can be exploited by attackers. This specific vulnerability arises from improper handling of PKCS#7 blobs during IKE certificate authentication, which can lead to system crashes.
Vulnerability Detail
Libreswan contains a null pointer dereference bug in its PKCS#7 handling code for IKE certificate authentication. When it processes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it incorrectly allows a null pointer dereference due to a mismatch between two NSS APIs. The SEC_PKCS7ContainsCertsOrCrls() function indicates that there are certificates or CRLs present, allowing the process to continue, while the SEC_PKCS7GetCertificateList() function returns NULL, leading to a crash. This vulnerability can be triggered by a malicious IKE_AUTH packet without requiring peer authentication, resulting in a denial of service. However, it does not allow for remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing strict validation of incoming IKE_AUTH packets to prevent the processing of potentially malicious payloads until a patch is applied.
Conclusion
The null pointer dereference vulnerability in Libreswan poses a significant risk of denial of service through malicious IKE_AUTH packets. It is crucial to update the package to the latest version to mitigate this risk. Users are encouraged to monitor their systems and apply the necessary patches promptly.
See every vulnerability recorded for libreswan →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
No, this vulnerability does not allow for remote code execution; it primarily leads to a denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package immediately, implement strict validation of incoming IKE_AUTH packets as a temporary workaround.
Yes, ensure that you are using the latest version of Libreswan that includes the patch for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
