CLEANSTART-2026-NB78178 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...

EUVD-2026-100747

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

DEBIAN-CVE-2026-77205

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

CVE-2026-77205

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

CVE-2026-77205

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

UBUNTU-CVE-2026-77205

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

CVE-2026-77205

Libreswan running in FIPS mode is vulnerable to a denial-of-service condition where malformed X.509 certificates are rejected but persist in the NSS certificate cache . This occurs because the add_decoded_cert() function fails to call CERT_DestroyCertificate(), a regression from a previous fix fo...

CVE-2026-77205

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

CVE-2026-77205 Denial of Service via sending bogus X.509 certificates

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

CVE-2026-77205

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

CVE-2026-77205

A flaw was found in Libreswan's handling of malformed X.509 certificates when running in FIPS mode. A remote attacker may cause a rejected certificate to remain in the NSS certificate cache, resulting in legitimate certificates with the same serial number being rejected. This can prevent affected...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...

PT-2026-113535

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The add decod...

CVE-2026-77205: Missing Release of Resource after Effective Lifetime

Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a result, any real certificates with the same serial number are rejected as well. This can be abused to lock out legitimate peers from connecting. The...

CLEANSTART-2026-XH38250 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

CVE-2026-59969 affects multiple packages. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. See references for individual vulnerability details...

CLEANSTART-2026-JQ32755 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Security vulnerability affects the spark package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...

AlmaLinux 9.2 [TuxCare] Security Update: libreswan (ALMALINUX9.2:CLSA-2026:1785422092)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785422092 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

Rocky Linux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1785496521)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785496521 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

AlmaLinux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1785496521)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785496521 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

Rocky Linux 9.6 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc (ALMALINUX9.6:CLSA-2026:1783706054)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783706054 advisory. - A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie- Hellman Group Exchange DH-GEX...