Libreswan in FIPS mode contains a flaw in the add_decoded_cert() function. When processing an X.509 certificate in a CERT payload, the code calls CERT_ExtractPublicKey() and asserts that the result is non-NULL. If CERT_ExtractPublicKey() returns NULL, as when an RSA exponent is zero, the assertion fails, causing the pluto daemon to abort and restart. A remote attacker can craft such a malformed CERT payload to trigger this assertion over a publicly reachable IPsec interface. The resulting crash leads to a denial of service; there is no possibility of remote code execution.

This vulnerability impacts installations of the libreswan IPsec daemon that run in FIPS mode and have at least one CA certificate loaded in the NSS database, and this effect only occurs when both the OS and libreswan are operating in FIPS mode. Both IKEv1 and IKEv2 traffic are affected. Configurations that use only PreSharedKey authentication without any CA certificates loaded are not vulnerable.

The CVSS score of 7.5 classifies the flaw as moderate-to-high severity. The EPSS score is not available, so the exact exploitation probability is unknown, but the attack requires only sending a crafted CERT payload over an open IPsec interface. The vulnerability is not listed in the CISA KEV catalog. The denial-of-service impact results from the pluto process aborting; repeated exploitation can keep the VPN service unavailable until it is manually or automatically restarted.