Description
Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.
Published: 2026-07-02
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the RSA_authenticate_hash_signature_raw_rsa function within Libreswan. An attacker can craft an IKEv1 SIG payload that, when encoded with PKCS #1 RSA Encryption as defined in RFC 2313, bypasses the authentication hash length check. This allows the attacker to forge the signature, impersonate a peer, or deliver a truncated hash that triggers an assertion, causing the daemon to abort. The abort leads to a restart loop that results in a sustained denial of service. No remote code execution is possible and X.509 peer verification remains unaffected.

Affected Systems

Libreswan VPN installations running any version older than 5.3.1 are affected. The issue also exists in the 4.15 release, for which a patch is available. The official fix is to upgrade to version 5.3.1 or later; patches for 4.15 and 5.3 can be applied if an upgrade cannot be performed immediately.

Risk and Exploitability

The flaw carries a CVSS score of 8.1, while the EPSS probability is below 1%. Because the exploit relies on sending a crafted IKEv1 packet over the network, attackers must reach the VPN endpoint. Repeated crashes can produce a prolonged denial of service, but impersonation requires precise manipulation of small public exponents such as e=3. The vulnerability is not listed in the CISA KEV catalog, and no remote code execution is feasible, so it represents a high‑severity operational risk rather than a system compromise. Until the vendor’s update is applied or traffic is shifted to IKEv2, the risk remains.

Generated by OpenCVE AI on July 21, 2026 at 10:44 UTC.

Remediation

Vendor Solution

Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50721/

Vendor Workaround

IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where authby=ecdsa or authby=rsa-sha2 can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via authby=secret after coordination with the remote peer.

OpenCVE Recommended Actions

  • Upgrade Libreswan to version 5.3.1 or later.
  • If remaining on older releases, apply the patches for 4.15 or 5.3 from the provided URLs.
  • Reconfigure all VPN tunnels to use IKEv2 with authby=ecdsa or authby=rsa-sha2; for static tunnel configurations, consider switching authentication to a pre‑shared key by setting authby=secret after coordinating with the remote peer.

Generated by OpenCVE AI on July 21, 2026 at 10:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 07 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Libreswan
Libreswan libreswan
Vendors & Products Libreswan
Libreswan libreswan

Thu, 02 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.
Title IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload
Weaknesses CWE-347
CWE-617
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Libreswan Libreswan
cve-icon MITRE

Status: PUBLISHED

Assigner: libreswan

Published:

Updated: 2026-07-07T17:01:58.011Z

Reserved: 2026-06-05T16:10:05.751Z

Link: CVE-2026-50721

cve-icon Vulnrichment

Updated: 2026-07-06T18:12:18.227Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-50721 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:45:02Z

Weaknesses
  • CWE-347

    Improper Verification of Cryptographic Signature

  • CWE-617

    Reachable Assertion