ALSA-2026:89923: Important: libreswan security update

Published Oct 26, 2026

Updated

Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).

Security Fix(es):

libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453) libreswan: Denial of Service via sending bogus X.509 certificates (CVE-2026-77205) libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/libreswan to a version that resolves this vulnerability.
Fixed in 5.3.3-1.el10_2
Upgrade
Upgrade almalinux/libreswan-minimal to a version that resolves this vulnerability.
Fixed in 5.3.3-1.el10_2

Event History

Oct 26, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

Which Libreswan deployments are exposed to the use-after-free issue?

The use-after-free issue affects IKEv2 when IKE-over-TCP is in use. Deployments that do not use IKE-over-TCP are not identified by the advisory as affected by that specific issue.

What input is associated with the denial-of-service issues?

One denial-of-service issue is triggered by bogus X.509 certificates. Another involves a PKCS#7 bundle that contains no CERTS, resulting in a null pointer dereference.

What functionality should be reviewed first while applying this update?

Review IKEv2 configurations that enable IKE-over-TCP and certificate-processing paths that accept X.509 certificates or PKCS#7 bundles. These are the components explicitly associated with the listed security fixes.

ALSA-2026:89923: Important: libreswan security update

Remediation

Event History

Frequently Asked Questions

Which Libreswan deployments are exposed to the use-after-free issue?

What input is associated with the denial-of-service issues?

What functionality should be reviewed first while applying this update?

Company

Resources

Contact

Frequently Asked Questions

Which Libreswan deployments are exposed to the use-after-free issue?

What input is associated with the denial-of-service issues?

What functionality should be reviewed first while applying this update?