CVE-2026-50721
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Libreswan has a vulnerability in the RSA_authenticate_hash_signature_raw_rsa() function that incorrectly verifies the authentication hash length in IKEv1 packets using PKCS #1 RSA encoding. A remote attacker can forge the SIG payload via a Bleichenbacher-style attack, leading to impersonation, or cause denial-of-service by sending a shorter hash.
Risk Assessment
The risk includes potential impersonation of remote IKE peers and sustained denial-of-service (daemon restarts on each attack). Remote code execution is not possible.
Recommendation
Update Libreswan to a patched version immediately. As a workaround, restrict access to IKEv1 services and use larger public exponents (e.g., e=65537).
Other vulnerabilities in Libreswan
See all- CVE-2016-5391High
Libreswan before 3.18 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to a restart of the pluto daemon.
- CVE-2016-5361High
In libreswan before version 3.17, there is an issue with retransmission in initial responder states, allowing remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet.
- CVE-2016-3071High
Libreswan version 3.16 may allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.
- CVE-2026-50722High
In Libreswan, the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa() incorrectly verifies the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload uses RSASSA-PKCS1-v1_5. A remote attacker can exploit a Bleichenbacher-style attack to forge the AUTH payload, leading to impersonation, or trigger an assertion causing denial-of-service.
- CVE-2026-12413High
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. An off-by-one error in the PASSERT assertion leads to daemon abort.
- CVE-2023-38711Medium
An issue was discovered in Libreswan before version 4.12, occurring when an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN. This causes a NULL pointer dereference, resulting in a crash and restart of the pluto daemon.
- CVE-2023-38710Medium
An issue was discovered in Libreswan before version 4.12 related to IKEv2 Child SA REKEY packets containing an invalid IPsec protocol ID of 0 or 1. This results in an error notify INVALID_SPI being sent back, causing the pluto daemon to crash.
Original NVD description (English source)
Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.