VDB
CVE-2026-77205
CVE-2026-77205
PUBLISHED
CVSS 3.7 LOW
Reported by libreswan · Published October 13, 2026
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.
Risk Scores
CVSS 3.1
3.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| The Libreswan Project | libreswan | 5.3, 5.3.3 |
| alpine | libreswan | 0 |
| The Libreswan Project | libreswan | 5.3, 5.3.3 |
Timeline
- Oct 13, 2026 CVE Published
- Oct 14, 2026 EPSS Score
- Oct 16, 2026 CVE Updated
- Oct 21, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
- Oct 28, 2026 Distribution Patch
- Oct 28, 2026 Security Advisory