CVE-2026-77206

Received Received - Intake

Null Pointer Dereference in Libreswan IKEv2 State Machine

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Libreswan Project

Description

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77206

EUVD

EUVD-2026-100748

Affected Vendors & Products

Vendor	Product	Version / Range
The	Libreswan	Project libreswan 4.7
The	Libreswan	Project libreswan 5.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

Libreswan's IKEv2 state machine contains a null pointer dereference bug in the EAP handling code during authentication. This bug occurs due to inconsistent state machine logic, allowing it to be triggered by any IKEv2 connection, even without EAP configured. A malicious IKE_AUTH packet can exploit this, causing the pluto daemon to crash and restart. No remote code execution is possible.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes in the Libreswan pluto daemon. Check system logs for pluto daemon crashes or restarts. Use commands like 'journalctl -u pluto' or 'grep -i crash /var/log/syslog' to identify patterns. No specific commands target this bug directly as it manifests as a crash.

Impact Analysis

This vulnerability can cause denial of service by repeatedly crashing and restarting the pluto daemon. It does not allow unauthorized access or data theft, but may disrupt VPN services relying on Libreswan for IKEv2 authentication.

Compliance Impact

The vulnerability may impact compliance by causing service disruptions, potentially violating availability requirements in GDPR or HIPAA. However, since no data exposure occurs, confidentiality and integrity requirements are unaffected.

Mitigation Strategies

Update Libreswan to the latest patched version immediately. If updating is not possible, disable IKEv2 EAP authentication temporarily by modifying configuration files to avoid triggering the null pointer dereference. Restart the pluto daemon after changes.

Hi! I’m here to help you understand CVE-2026-77206. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70