CVE-2026-77206

HIGH 7.5

IKEv2 pre-authentication Null Pointer Dereference in EAP code

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.

CWE	CWE-476
Vendor	the libreswan project
Product	libreswan
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for the libreswan project libreswan

Be the first to know when new high vulnerabilities affecting the libreswan project libreswan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

The Libreswan Project / libreswan

4.7 ≤ 5.3.2 5.4 ≤ 5.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

libreswan.org: https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt libreswan.org: https://libreswan.org/security/CVE-2026-77206/

Credits

Claude (Anthropic) 🔍 David Korczynski (ADA Logics Ltd)