Bug 2550258 (CVE-2026-77207)

Summary:	CVE-2026-77207 libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, echaudro, fleitner, jdelft, jupierce, ktraynor, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, rkhan, sfaye, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A null pointer dereference flaw was found in Libreswan's PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2550633
Bug Blocks:

Description OSIDB Bzimport 2026-10-13 08:01:33 UTC

The Libreswan Project was informed of a Null Pointer Dereference bug in the PKCS#7 handling code for authentication that can result in a denial of service against the libreswan pluto daemon. 

When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no
certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart.

An malicious IKE_AUTH packet can trigger this bug, meaning the peer need not be authenticated. Continued attempts to use IKEv2 with such malicious payloads can cause a denial of service. No remote code execution is possible.

Vulnerable versions : 4.7 - 5.4
Not vulnerable      : 5.3.3, 5.4.1