CVE-2026-50721 Details
Description
Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.
A vulnerability in Libreswan's IKEv1 implementation allows for denial-of-service and impersonation attacks via improperly validated RSA authentication payloads. This issue arises when the SIG payload is encoded using PKCS #1 RSA Encryption, as specified in RFC 2313. Remote attackers can exploit this vulnerability by using small public exponents, such as 3, to forge signatures, bypassing authentication. Additionally, attackers can encode shorter-than-expected hashes in the SIG payload, triggering an assertion that causes the Libreswan daemon to crash and restart, leading to a sustained denial-of-service condition.
Users can upgrade to Libreswan version 5.3.1 or later, or apply the available patches for Libreswan versions 4.15 and 5.3.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://libreswan.org/security/CVE-2026-50721/ | Libreswan Project | Vendor Advisory |
| https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt | Libreswan Project | Vendor Advisory |
| https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt | Libreswan Project | Vendor Advisory |
| https://www.rfc-editor.org/rfc/rfc2313 | Libreswan Project | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | Libreswan Project |
| CWE-617 | Reachable Assertion | Libreswan Project |
Affected Products
| Product | Versions |
|---|---|
| libreswan libreswan | < 5.3.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | Libreswan Project |