CVE-2026-50722
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In Libreswan, the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa() incorrectly verifies the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload uses RSASSA-PKCS1-v1_5. A remote attacker can exploit a Bleichenbacher-style attack to forge the AUTH payload, leading to impersonation, or trigger an assertion causing denial-of-service.
Risk Assessment
The organization faces risk of impersonation in IKEv2 sessions and sustained denial-of-service (DoS) due to repeated daemon restarts triggered by crafted AUTH payloads.
Recommendation
Immediately update Libreswan to a patched version. Until then, avoid using small public exponents (e.g., e=3) in certificates and monitor logs for unusual daemon restarts.
Other vulnerabilities in Libreswan
See all- CVE-2016-5391High
Libreswan before 3.18 allows remote attackers to cause a denial of service via NULL pointer dereference, leading to a restart of the pluto daemon.
- CVE-2016-5361High
In libreswan before version 3.17, there is an issue with retransmission in initial responder states, allowing remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet.
- CVE-2016-3071High
Libreswan version 3.16 may allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transform.
- CVE-2026-50721High
Libreswan has a vulnerability in the RSA_authenticate_hash_signature_raw_rsa() function that incorrectly verifies the authentication hash length in IKEv1 packets using PKCS #1 RSA encoding. A remote attacker can forge the SIG payload via a Bleichenbacher-style attack, leading to impersonation, or cause denial-of-service by sending a shorter hash.
- CVE-2026-12413High
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. An off-by-one error in the PASSERT assertion leads to daemon abort.
- CVE-2023-38711Medium
An issue was discovered in Libreswan before version 4.12, occurring when an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN. This causes a NULL pointer dereference, resulting in a crash and restart of the pluto daemon.
- CVE-2023-38710Medium
An issue was discovered in Libreswan before version 4.12 related to IKEv2 Child SA REKEY packets containing an invalid IPsec protocol ID of 0 or 1. This results in an error notify INVALID_SPI being sent back, causing the pluto daemon to crash.
Original NVD description (English source)
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.