CVE-2026-77205

Denial of Service via sending bogus X.509 certificates

State: Published
Severity: 3.7 Low
Published: Oct 13, 2026
Updated: Oct 16, 2026
Reserved: Aug 20, 2026

Description

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.

Scores

CVSS	Score	Vector	Source
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L	libreswan

Weaknesses

CWE-772 Missing Release of Resource after Effective Lifetime

Affected Products

Product	Versions
libreswanThe Libreswan Project	5.3 through 5.3.2Affected 5.3.3Not affected

References

Libreswan Security Advisory CVE-2026-77205vendor-advisory
Libreswan CVE-2026-77205 Patchespatch
Related: CVE-2026-14957 (incorrect fix being corrected)related

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.