Bug 2550256 (CVE-2026-77206) - CVE-2026-77206 libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code
Summary: CVE-2026-77206 libreswan: IKEv2 pre-authentication Null Pointer deref in EAP ...
Keywords:
Status: NEW
Alias: CVE-2026-77206
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2550632
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-13 07:58 UTC by OSIDB Bzimport
Modified: 2026-10-13 15:41 UTC (History)
22 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-13 07:58:07 UTC 
The Libreswan Project was informed of a Null Pointer Dereference bug in the EAP handling code for authentication that can result in a denial of service against the libreswan pluto daemon. 

As a result of inconsistency within the IKEv2 state machine code, a bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The bug results in a crash and restart. No remote code execution is possible. The error is caused by a fall-through error where it incorrectly dereferences ike->sa.st_eap which is NULL.

An malicious IKE_AUTH packet can trigger this bug, meaning the peer need not be authenticated. Continued attempts to use IKEv2 with such malicious payloads can cause a denial of service. No remote code execution is possible.

Vulnerable versions : 4.7 - 5.4
Not vulnerable      : 5.3.3, 5.4.1
Note You need to log in before you can comment on or make changes to this bug.