Read the docs
Red Hat Security Advisory

RHSA-2026:89748

libreswan security update

Released 2026-10-26 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 3 records

TI-2026-73733 CVE-2026-77206 · GHSA-37xg-hvw9-pr82

NULL pointer dereference in Libreswan IKEv2 EAP handling

Priority MEDIUM 40

Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00658 Published 2026-10-13 Partial fix · 5.3.3, 5.4.1 CWE-476
TI-2026-73738 CVE-2026-94453 · GHSA-59fc-px6w-3g8v

Use-after-free in Libreswan IKE over TCP handling

Priority LOW 39

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00454 Published 2026-10-13 Partial fix · 5.3.3, 5.4.1 CWE-416
TI-2026-73734 CVE-2026-77207 · GHSA-jf6r-wr9w-j67c

Null pointer dereference in Libreswan PKCS#7 bundle handling

Priority LOW 39

Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00463 Published 2026-10-13 Partial fix · 5.3.3, 5.4.1 CWE-252