CVE-2026-77205
Low · CVSS 3.7Published 2026-10-13
CVSS
3.7
Low
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-77205?
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.
CVSS Score Explained
CVSS 3.7 is Low severity. Impact is limited and exploitation is difficult. Patch when convenient.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt
- ›https://libreswan.org/security/CVE-2026-77205/
- ›https://libreswan.org/security/CVE-2026-77205/CVE-2026-77205.txt
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-88964An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options7.1
- CVE-2026-53564Vulnerability in Citrix UniconOS leading to Arbitrary file read and write
This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.5.1
- CVE-2026-15468Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.
This issue affects HYPR Passwordless: before 11.3.3.6.9
- CVE-2026-53563Vulnerability in Citrix UniconOS leading to Persistent Command Execution
This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.6.9
- CVE-2026-105142Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-105151Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—