The vulnerability is a cryptographic verification flaw (CWE‑347) coupled with an improper assertion handling (CWE‑617). Libreswan’s RSA_authenticate_hash_signature_pkcs1_1_5_rsa() function failed to validate the ASN.1 digest encoding of the IKEv2 AUTH payload when the payload was signed with RSASSA‑PKCS1‑v1_5. This shortens the expected hash or introduces specially crafted padding that can be used by a remote attacker to forge a valid AUTH message or, when small public exponents are used, to exploit a Bleichenbacher‑style attack leading to impersonation. The forged payloads permit the attacker to impersonate the remote peer or to trigger an assertion that causes the daemon to abort and restart. The result is either identity spoofing or a repeatable denial‑of‑service condition. Remote code execution is not possible, and certificate verification is unaffected.

All Libreswan releases before version 5.3.1 contain the vulnerability. The 4.15 and 5.3 branches can be hardened by applying the patches issued by the Libreswan Project.1 and newer incorporate the VPN daemon that implements IKEv2 on Linux and other Unix‑like systems.

Based on the description, it is inferred that the attack vector is purely network‑based: an adversary who can reach a vulnerable IKEv2 endpoint can send a crafted AUTH payload, potentially leveraging small public exponents (e=3), without user interaction. The CVSS score of 8.1 designates high severity, but the EPSS score is below 1 %, indicating a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation could allow the attacker to impersonate a legitimate peer or continuously crash the daemon, resulting in sustained denial of service.