CVE-2026-77205

Published: Ott 14, 2026 Last Modified: Ott 14, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 3,7
Source: d42dc95b-23f1-4e06-9076-20753a0fb0df
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low

Description

AI Translation Available

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.

772

Missing Release of Resource after Effective Lifetime

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Other) Dos: Resource Consumption (Memory) Dos: Resource Consumption (Cpu)
Applicable Platforms
Technologies: Mobile
Likelihood of Exploit: High
View CWE Details
https://libreswan.org/security/CVE-2026-14957/CVE-2026-1495…
https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt
https://libreswan.org/security/CVE-2026-77205/
https://libreswan.org/security/CVE-2026-77205/
https://libreswan.org/security/CVE-2026-77205/CVE-2026-7720…
https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt