REDHAT-BUG-2550258: Null Pointer Dereference

Q: What does an attacker need to exploit this issue?

An attacker only needs to send a malicious IKE_AUTH packet containing a CERT_PKCS7_WRAPPED_X509 payload with a SignedData structure that includes a CRL but no certificates. The peer does not need to be authenticated.

Q: What is the operational impact of successful exploitation?

The malformed payload causes the libreswan pluto daemon to dereference a null pointer, crash, and restart. Repeated malicious IKEv2 attempts can sustain a denial-of-service condition; remote code execution is not possible.

Q: Which versions are affected?

Versions 4.7 through 5.4 are listed as vulnerable, except for 5.3.3 and 5.4.1, which are listed as not vulnerable.

Published Oct 13, 2026

Updated

The Libreswan Project was informed of a Null Pointer Dereference bug in the PKCS#7 handling code for authentication that can result in a denial of service against the libreswan pluto daemon.

When libreswan decodes an IKE CERT payload of type CERTPKCS7WRAPPEDX509, it guards the PKCS#7 blob with SECPKCS7ContainsCertsOrCrls() and then iterates the certificate list with SECPKCS7GetCertificateList(). The two NSS APIs disagree on a SignedData that carries a CRL but no certificates: ContainsCertsOrCrls() returns PRTRUE (there is a CRL), so the guard passes, but GetCertificateList() returns NULL (there are no certificates). This causes libreswan to dereference a null pointer leading to a crash and restart.

An malicious IKEAUTH packet can trigger this bug, meaning the peer need not be authenticated. Continued attempts to use IKEv2 with such malicious payloads can cause a denial of service. No remote code execution is possible.

Vulnerable versions : 4.7 - 5.4 Not vulnerable : 5.3.3, 5.4.1

Affected Software

1 affected component

libreswan Libreswan>=4.7<5.3.3, >=5.4<5.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libreswan to a version that resolves this vulnerability.
Fixed in 5.4.1

Event History

Oct 13, 2026

Data Sourced

via Red Hat·08:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker only needs to send a malicious IKE_AUTH packet containing a CERT_PKCS7_WRAPPED_X509 payload with a SignedData structure that includes a CRL but no certificates. The peer does not need to be authenticated.

What is the operational impact of successful exploitation?

The malformed payload causes the libreswan pluto daemon to dereference a null pointer, crash, and restart. Repeated malicious IKEv2 attempts can sustain a denial-of-service condition; remote code execution is not possible.

Which versions are affected?

Versions 4.7 through 5.4 are listed as vulnerable, except for 5.3.3 and 5.4.1, which are listed as not vulnerable.

REDHAT-BUG-2550258: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the operational impact of successful exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the operational impact of successful exploitation?

Which versions are affected?