CVE-2026-77205
Denial of Service via sending bogus X.509 certificates
- Published
- Updated
- Reserved
- Assigned by
- libreswan
Description
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| libreswanCNA (assigner) | 3.1 | Low3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Awaiting Analysis | 3.1 | Low3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
- EPSS (exploitation in 30 days)
- 0.18% · top 92% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.7.
Weakness
Affected products
The Libreswan Project · libreswan
- affected 5.3 – ≤ 5.3.2
- unaffected 5.3.3
What to do
Solution: Upgrade to libreswan 5.3.3 or later. Patches are available at https://libreswan.org/security/CVE-2026-77205/
Workaround: Disabling FIPS mode will prevent this attack vector. If this is not possible, upgrade to a later libreswan version or apply the available patch.
Exploitation: No known exploitation in the wild. An attacker could trick a peer into connecting to them first to learn the serial number, then use that to prevent the peer from connecting to the legitimate server. Exploitation requires FIPS mode to be enabled.
References (3)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-77205)Record last updated .