Is CVE-2026-77205 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-77205?

CVE-2026-77205 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-77205

Description

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.