Bug 2550258 (CVE-2026-77207) - CVE-2026-77207 libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS
Summary: CVE-2026-77207 libreswan: Null Pointer Dereference in PKCS#7 bundle with no C...
Keywords:
Status: NEW
Alias: CVE-2026-77207
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2550633
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-13 08:01 UTC by OSIDB Bzimport
Modified: 2026-10-13 15:41 UTC (History)
22 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-13 08:01:33 UTC 
The Libreswan Project was informed of a Null Pointer Dereference bug in the PKCS#7 handling code for authentication that can result in a denial of service against the libreswan pluto daemon. 

When libreswan decodes an IKE CERT payload of type CERT_PKCS7_WRAPPED_X509, it guards the PKCS#7 blob with SEC_PKCS7ContainsCertsOrCrls() and then iterates the certificate list with SEC_PKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no
certificates: ContainsCertsOrCrls() returns PR_TRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart.

An malicious IKE_AUTH packet can trigger this bug, meaning the peer need not be authenticated. Continued attempts to use IKEv2 with such malicious payloads can cause a denial of service. No remote code execution is possible.

Vulnerable versions : 4.7 - 5.4
Not vulnerable      : 5.3.3, 5.4.1
Note You need to log in before you can comment on or make changes to this bug.