Description (CNA)
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| The Libreswan Project / libreswan | affected 5.3 through 5.3.2; unaffected 5.3.3 |
CWE
CWE-772
References
- https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt
- https://libreswan.org/security/CVE-2026-77205/
- https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt
ADP enrichment
No English description supplied.
No references supplied.