CVE-2026-77205

Katalog CVE

CVSS 3.7 · Low

Kerentanan Missing Release of Resource after Effective Lifetime. Skor CVSS 3.1 3.7 (Low) menurut CNA.

Deskripsi (NVD)

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.

Rincian

Terbit di NVD

13 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Received

CVSS 3.1

3.7 (Low), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-772: Missing Release of Resource after Effective Lifetime

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt
• https://libreswan.org/security/CVE-2026-77205/
• https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt