# CVE-2026-77206: Libreswan IKEv2 null pointer dereference in EAP handling

Source: https://junglewise.ai/threats/cve-2026-77206-libreswan-s-ikev2-state-machine-has-a-null-pointer-dereference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-77206 · Severity: high · CVSS 7.5 · Published 2026-10-13

Libreswan is a VPN client and server that secures network communications using IPsec encryption. A defect in its IKEv2 authentication code allows an attacker to send a crafted network packet that crashes the VPN daemon, causing denial of service. No authentication is required and attacks can be repeated to maintain the outage.

Technologies: [Libreswan](https://junglewise.ai/threats/technologies/libreswan-libreswan). Vendors: [Libreswan](https://junglewise.ai/threats/vendors/libreswan).

## Quick answers

**Is CVE-2026-77206 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77206 being exploited in the wild.

**How severe is CVE-2026-77206?** High severity, with a CVSS score of 7.5, published 13 October 2026.

**Which products and versions are affected?** Libreswan 5.3 and earlier.

**Is there a fix for CVE-2026-77206?** Yes: fixed in Libreswan 5.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77206 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77206?** Check whether you run Libreswan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Libreswan 5.4

## Technical details

A null pointer dereference exists in Libreswan's IKEv2 state machine within the EAP authentication handler, where ike->sa.st_eap is dereferenced without being checked for NULL. The vulnerability can be triggered by any IKEv2 connection regardless of EAP configuration, via a malicious IKE_AUTH packet sent over the network without prior authentication. Exploitation causes the pluto daemon to crash and restart; remote code execution is not possible, but repeated exploitation results in denial of service.

## Affected products

- Libreswan Libreswan 5.3 and earlier

## Timeline

- 2026-10-13: advisory

## References

- [https://github.com/libreswan/libreswan](https://github.com/libreswan/libreswan)
- [https://libreswan.org/security/CVE-2026-77206/](https://libreswan.org/security/CVE-2026-77206/)

## Related threats

- [Libreswan pluto use-after-free in IKE over TCP](https://junglewise.ai/threats/cve-2026-94453-libreswan-s-pluto-daemon-has-a-use-after-free-vulnerability-when)
- [Libreswan null pointer dereference in PKCS#7 handling](https://junglewise.ai/threats/cve-2026-77207-libreswan-has-a-null-pointer-dereference-bug-in-the-pkcs-7)