Denial of Service via sending bogus X.509 certificates

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-77205",
    "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
    "assignerShortName": "libreswan",
    "dateUpdated": "2026-10-13T21:28:03.390Z",
    "dateReserved": "2026-08-20T18:13:09.377Z",
    "datePublished": "2026-10-13T21:28:03.390Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "shortName": "libreswan",
        "dateUpdated": "2026-10-13T21:28:03.390Z"
      },
      "title": "Denial of Service via sending bogus X.509 certificates",
      "descriptions": [
        {
          "lang": "en",
          "value": "Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted."
        }
      ],
      "affected": [
        {
          "vendor": "The Libreswan Project",
          "product": "libreswan",
          "collectionURL": "https://github.com/libreswan/libreswan",
          "packageName": "libreswan",
          "programRoutines": [
            {
              "name": "add_decoded_cert"
            }
          ],
          "repo": "https://github.com/libreswan/libreswan",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5.3",
              "status": "affected",
              "versionType": "semver",
              "lessThanOrEqual": "5.3.2"
            },
            {
              "version": "5.3.3",
              "status": "unaffected",
              "versionType": "semver"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "CWE-772: Missing Release of Resource after Effective Lifetime",
              "cweId": "CWE-772",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt",
          "name": "Libreswan Security Advisory CVE-2026-77205",
          "tags": [
            "vendor-advisory"
          ]
        },
        {
          "url": "https://libreswan.org/security/CVE-2026-77205/",
          "name": "Libreswan CVE-2026-77205 Patches",
          "tags": [
            "patch"
          ]
        },
        {
          "url": "https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt",
          "name": "Related: CVE-2026-14957 (incorrect fix being corrected)",
          "tags": [
            "related"
          ]
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of service by preventing legitimate peers from connecting through cache poisoning with bogus certificates"
            }
          ]
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ],
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW"
          }
        },
        {}
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Only configurations running in FIPS mode are vulnerable. Verify FIPS mode and loaded CA certificates with 'sudo ipsec fipsstatus' and 'sudo ipsec listcacerts'."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Disabling FIPS mode will prevent this attack vector. If this is not possible, upgrade to a later libreswan version or apply the available patch."
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to libreswan 5.3.3 or later. Patches are available at https://libreswan.org/security/CVE-2026-77205/"
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "No known exploitation in the wild. An attacker could trick a peer into connecting to them first to learn the serial number, then use that to prevent the peer from connecting to the legitimate server. Exploitation requires FIPS mode to be enabled."
        }
      ],
      "timeline": [
        {
          "time": "2026-07-30T00:00:00.000Z",
          "lang": "en",
          "value": "Libreswan was notified of the issue via security@libreswan.org"
        },
        {
          "time": "2026-09-24T00:00:00.000Z",
          "lang": "en",
          "value": "Advanced notice given to supported customers and distributions"
        },
        {
          "time": "2026-10-05T00:00:00.000Z",
          "lang": "en",
          "value": "Public announcement and release of libreswan 5.3.3"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Wojciech Tatarski (TuxCare)",
          "type": "finder"
        }
      ],
      "taxonomyMappings": [
        {
          "taxonomyName": "ATT&CK",
          "taxonomyVersion": "15.1",
          "taxonomyRelations": [
            {
              "taxonomyId": "T1499.004",
              "relationshipName": "maps to",
              "relationshipValue": "Application or System Exploitation (DoS)"
            }
          ]
        }
      ]
    }
  }
}