CVE-2026-50722 Details
Description
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.
A denial-of-service vulnerability has been identified in Libreswan versions through 5.3, specifically within the IKEv2 protocol implementation. The issue arises in the RSA authentication process, where the library fails to properly validate the DER encoding of the ASN.1 digest in the AUTH payload when using RSASSA-PKCS1-v1_5 encryption, as specified in RFC 8017. This flaw allows remote attackers to exploit variations of the Bleichenbacher attack to forge AUTH payloads, potentially leading to impersonation. Additionally, attackers can cause the application to crash and restart by sending improperly formatted payloads, creating a sustained denial-of-service condition.
Users can upgrade to Libreswan version 5.3.1 or later to address this vulnerability. For those unable to upgrade, patches are available for Libreswan versions 4.15 and 5.3.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt | Libreswan Project | Vendor AdvisoryMailing List |
| https://libreswan.org/security/CVE-2026-50722/ | Libreswan Project | Vendor Advisory |
| https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt | Libreswan Project | Vendor Advisory |
| https://www.rfc-editor.org/rfc/rfc8017 | Libreswan Project | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | Libreswan Project |
| CWE-617 | Reachable Assertion | Libreswan Project |
Affected Products
| Product | Versions |
|---|---|
| libreswan libreswan | < 5.3.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | Libreswan Project |