{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77205",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:14:28.040688Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:31:54.457Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/libreswan/libreswan",
          "defaultStatus": "unaffected",
          "packageName": "libreswan",
          "product": "libreswan",
          "programRoutines": [
            {
              "name": "add_decoded_cert"
            }
          ],
          "repo": "https://github.com/libreswan/libreswan",
          "vendor": "The Libreswan Project",
          "versions": [
            {
              "lessThanOrEqual": "5.3.2",
              "status": "affected",
              "version": "5.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.3.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Only configurations running in FIPS mode are vulnerable. Verify FIPS mode and loaded CA certificates with \u0027sudo ipsec fipsstatus\u0027 and \u0027sudo ipsec listcacerts\u0027."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wojciech Tatarski (TuxCare)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "No known exploitation in the wild. An attacker could trick a peer into connecting to them first to learn the serial number, then use that to prevent the peer from connecting to the legitimate server. Exploitation requires FIPS mode to be enabled."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of service by preventing legitimate peers from connecting through cache poisoning with bogus certificates"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "description": "Vendor-assessed severity: Low. Exploitation requires FIPS mode to be enabled and either guessing or learning certificate serial numbers. Certificate Authorities should use randomized serial numbers per best practice.",
              "value": "LOW"
            },
            "type": "vendorSeverity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-772",
              "description": "CWE-772: Missing Release of Resource after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T21:28:03.390Z",
        "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "shortName": "libreswan"
      },
      "references": [
        {
          "name": "Libreswan Security Advisory CVE-2026-77205",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt"
        },
        {
          "name": "Libreswan CVE-2026-77205 Patches",
          "tags": [
            "patch"
          ],
          "url": "https://libreswan.org/security/CVE-2026-77205/"
        },
        {
          "name": "Related: CVE-2026-14957 (incorrect fix being corrected)",
          "tags": [
            "related"
          ],
          "url": "https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to libreswan 5.3.3 or later. Patches are available at https://libreswan.org/security/CVE-2026-77205/"
        }
      ],
      "source": {
        "defects": [
          "CVE-2026-77205"
        ],
        "discovery": "EXTERNAL"
      },
      "taxonomyMappings": [
        {
          "taxonomyName": "ATT\u0026CK",
          "taxonomyRelations": [
            {
              "relationshipName": "maps to",
              "relationshipValue": "Application or System Exploitation (DoS)",
              "taxonomyId": "T1499.004"
            }
          ],
          "taxonomyVersion": "15.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-30T00:00:00.000Z",
          "value": "Libreswan was notified of the issue via security@libreswan.org"
        },
        {
          "lang": "en",
          "time": "2026-09-24T00:00:00.000Z",
          "value": "Advanced notice given to supported customers and distributions"
        },
        {
          "lang": "en",
          "time": "2026-10-05T00:00:00.000Z",
          "value": "Public announcement and release of libreswan 5.3.3"
        }
      ],
      "title": "Denial of Service via sending bogus X.509 certificates",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disabling FIPS mode will prevent this attack vector. If this is not possible, upgrade to a later libreswan version or apply the available patch."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
    "assignerShortName": "libreswan",
    "cveId": "CVE-2026-77205",
    "datePublished": "2026-10-13T21:28:03.390Z",
    "dateReserved": "2026-08-20T18:13:09.377Z",
    "dateUpdated": "2026-10-16T15:31:54.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}