Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-77206— IKEv2 pre-authentication Null Pointer Dereference in EAP code

Quick assessment

Affected
The Libreswan Project libreswan
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LibreSWAN 的 IKEv2 状态机在处理 EAP 认证的代码中存在空指针解引用漏洞。由于 IKEv2 状态机代码内部存在不一致性，该漏洞可通过任何 IKEv2 连接触发，即使完全未配置 EAP。此错误源于代码中的穿透（fall-through）行为，导致其错误地解引用了 ike->sa.st_eap，而该指针为空。恶意 IKE_AUTH 数据包可触发此漏洞，且无需对对等实体进行身份验证。该漏洞会导致 pluto 守护进程崩溃并重启。目前不可能实现远程代码执行。持续利用该漏洞可导致拒绝服务（DoS）。

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77206

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
IKEv2 pre-authentication Null Pointer Dereference in EAP code
Source: CVE Program / CVE List V5
Vulnerability Description
Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency within the IKEv2 state machine code, this bug can be triggered by any IKEv2 connection, even if EAP is not configured at all. The error is caused by a fall-through where it incorrectly dereferences ike->sa.st_eap which is NULL. A malicious IKE_AUTH packet can trigger this bug, meaning the peer does not need to be authenticated. The bug results in a crash and restart of the pluto daemon. No remote code execution is possible. Continued exploitation can cause a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
The Libreswan Project libreswan 4.7 ~ 5.3.2 -

II. Public POCs for CVE-2026-77206

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77206

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-77206 (2)

Same Patch Batch · The Libreswan Project · 2026-10-13 · 4 CVEs total

CVE-2026-94453 7.5 HIGH IKEv2 Use-After-Free bug when using IKE-over-TCP
CVE-2026-77207 7.5 HIGH Null Pointer Dereference in PKCS#7 bundle with no certificates
CVE-2026-77205 3.7 LOW Denial of Service via sending bogus X.509 certificates

IV. Related Vulnerabilities

Same product: libreswan
Same vendor: The Libreswan Project
Same weakness: CWE-476

V. Comments for CVE-2026-77206

No comments yet

Leave a comment