CVE-2026-14957
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.
Risk Assessment
An attacker can cause repeated crashes of the pluto daemon, leading to disruption of VPN services and network unavailability.
Recommendation
Update Libreswan to a patched version, and consider disabling FIPS mode if not required, or load CA certificates only from trusted sources.
Other vulnerabilities in Libreswan
See all- CVE-2016-5391High
Libreswan before 3.18 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to a restart of the pluto daemon.
- CVE-2016-5361High
In libreswan before version 3.17, there is an issue with retransmission in initial responder states, allowing remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet.
- CVE-2016-3071High
Libreswan version 3.16 may allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.
- CVE-2026-50722High
In Libreswan, the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa() incorrectly verifies the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload uses RSASSA-PKCS1-v1_5. A remote attacker can exploit a Bleichenbacher-style attack to forge the AUTH payload, leading to impersonation, or trigger an assertion causing denial-of-service.
- CVE-2026-50721High
Libreswan has a vulnerability in the RSA_authenticate_hash_signature_raw_rsa() function that incorrectly verifies the authentication hash length in IKEv1 packets using PKCS #1 RSA encoding. A remote attacker can forge the SIG payload via a Bleichenbacher-style attack, leading to impersonation, or cause denial-of-service by sending a shorter hash.
- CVE-2026-12413High
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. An off-by-one error in the PASSERT assertion leads to daemon abort.
- CVE-2023-38711Medium
An issue was discovered in Libreswan before version 4.12, occurring when an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN. This causes a NULL pointer dereference, resulting in a crash and restart of the pluto daemon.
- CVE-2023-38710Medium
An issue was discovered in Libreswan before version 4.12 related to IKEv2 Child SA REKEY packets containing an invalid IPsec protocol ID of 0 or 1. This results in an error notify INVALID_SPI being sent back, causing the pluto daemon to crash.
Original NVD description (English source)
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS