CVE-2026-77205

Low

Description

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.

SeverityLow

CVSS3.7

Exploit probability—

ProductLibreswan

PublishedOct 13, 2026

First seenOct 13, 2026

Weakness typeCWE-772CWE-772

How to fix

Patches

libreswan.org/security/CVE-2026-77205/

Vendor advisories

libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt

Affected products

Product	Affected versions	Fixed in
The Libreswan Project libreswan	5.3 ≤ v ≤ 5.3.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.