ALAS2027-2026-233

References: CVE-2026-94453  CVE-2026-77206  CVE-2026-77207  CVE-2026-77205 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-94453:
A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service.

CVE-2026-77207:
A null pointer dereference flaw was found in Libreswan's PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service.

CVE-2026-77206:
A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.

CVE-2026-77205:
Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add_decoded_cert() function missed a call to CERT_DestroyCertificate() due to an incorrect fix for CVE-2026-14957. Sending bogus certificates with new serial numbers could prevent the real certificates with those serial numbers from connecting until the service has restarted.

Issue Correction:
Run dnf update libreswan --releasever 2027.0.20261026 or dnf update --advisory ALAS2027-2026-233 --releasever 2027.0.20261026 to update your system.

New Packages:

aarch64:
    libreswan-minimal-debuginfo-5.3.3-1.amzn2027.aarch64
    libreswan-5.3.3-1.amzn2027.aarch64
    libreswan-minimal-5.3.3-1.amzn2027.aarch64
    libreswan-debugsource-5.3.3-1.amzn2027.aarch64

src:
    libreswan-5.3.3-1.amzn2027.src

x86_64:
    libreswan-minimal-debuginfo-5.3.3-1.amzn2027.x86_64
    libreswan-5.3.3-1.amzn2027.x86_64
    libreswan-minimal-5.3.3-1.amzn2027.x86_64
    libreswan-debugsource-5.3.3-1.amzn2027.x86_64