CVE-2026-77205: Denial of Service via sending bogus X.509 certificates
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The adddecodedcert() function missed a call to CERTDestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libreswanto a version that resolves this vulnerability.Fixed in 5.3.3
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects Libreswan operating in FIPS mode. The provided information does not identify affected versions.
What must an attacker do to disrupt peer connections?
An attacker must send badly formed X.509 certificates using serial numbers that correspond to certificates legitimate peers will use. The malformed certificates are retained in the NSS cache, causing later real certificates with those serial numbers to be rejected.
Is authentication required to exploit this issue?
No privileges or user interaction are required according to the supplied vector. Exploitation is network-based, although the attack complexity is rated high.
What is the immediate workaround if a peer has been locked out?
Restart the affected service. The supplied information states that the blocked legitimate certificates can connect again only after the service has restarted.