EUVD-2026-69820
GHSA-x2hf-3rgr-r89x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach Libreswan IKE endpoint over UDP
-
DeliveryInitiate IKEv1 or IKEv2 handshake
-
ExploitSend CERT payload with malformed X.509 cert (RSA exponent=0)
-
InstallCERT_ExtractPublicKey() returns NULL
-
C2Hard assertion fires in add_decoded_cert()
-
ExecutePluto daemon aborts and restarts
-
ImpactRepeat to sustain VPN denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Both the operating system and Libreswan must be running in FIPS mode simultaneously - this is a non-default, compliance-driven configuration typically present in US federal government and regulated-industry deployments. Additionally, at least one CA certificate must be loaded in the NSS database for certificate-based IKE peer authentication; configurations using only PreSharedKey (PSK) authentication with no CA certificates in NSS are explicitly not vulnerable. No attacker credentials or prior authentication are required because the CERT payload is processed during IKE handshake initiation, before peer identity verification. The attacker must have network access to UDP port 500 or UDP port 4500 on the target Libreswan host. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly captures that once exploitation prerequisites are met, the attack is network-accessible, unauthenticated, and requires no user interaction. However, real-world risk is substantially bounded by two mandatory deployment conditions: both the OS and Libreswan must be in FIPS mode (a non-default configuration principally found in US government and regulated-industry environments), and at least one CA certificate must be loaded in the NSS database. PSK-only deployments are explicitly safe. These conditions mean the vulnerable population is a subset of all Libreswan deployments - not the broad installed base. EPSS data is absent from provided intelligence. No CISA KEV listing exists and no public exploit code has been identified, suggesting this has not been weaponized in the wild. The vendor's explicit confirmation that RCE is impossible limits the severity to a persistent DoS if continuously exploited. For FIPS-mode VPN gateways in regulated environments, this warrants prompt patching; for the general Libreswan user base, risk is low. |
| Exploit ScenarioDerived | An attacker with network access to a FIPS-mode Libreswan gateway initiates an IKE handshake and transmits a CERT payload containing a crafted X.509 certificate embedding an RSA public key with an exponent value of zero. The pluto daemon's |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Unauthenticated remote denial of service in Libreswan's pluto IKE daemon allows any network attacker to repeatedly crash and restart the VPN service by sending a malformed X.509 certificate in a CERT payload during IKE handshake negotiation. The crash is triggered by a reachable assertion in add_decoded_cert(): when NSS's CERT_ExtractPublicKey() receives a certificate with an invalid RSA exponent (e.g., zero), it returns NULL, which the FIPS-mode code path does not handle, causing the daemon to abort. The vendor explicitly confirms no remote code execution is possible; impact is limited to availability. No CISA KEV listing and no public exploit code have been identified at time of analysis.
RemediationAI
Apply the vendor-released patch available at https://libreswan.org/security/CVE-2026-14957/. The provided intelligence does not specify an exact patched version number; administrators should consult the advisory directly to identify the minimum safe release for their distribution. As an immediate workaround before patching, organizations with operational flexibility can disable FIPS mode for Libreswan, though this will typically violate compliance mandates in regulated environments and should only be considered after change-control approval. An alternative workaround is to remove all CA certificates from the NSS database and restrict connections to PreSharedKey authentication exclusively, which eliminates the vulnerable code path at the cost of losing certificate-based peer authentication. Restricting IKE traffic (UDP/500 and UDP/4500) via firewall rules to known and trusted peer IP addresses reduces the attacker population but does not eliminate risk from network-adjacent attackers or compromised peers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Libreswan (cpe:2.3:a:the_libreswan_project:libreswan) is an open-source IPsec/IKE VPN implementation for Linux, heavily deployed on RHEL, Fedora, and related distributions. The pluto daemon handles all IKE key-exchange and certificate processing. The root cause is CWE-617 (Reachable Assertion): in FIPS mode, add_decoded_cert() calls the NSS library function CERT_ExtractPublicKey() and uses a hard assert - rather than a graceful error check - that the return value must be non-NULL. NSS legitimately returns NULL for certificates with malformed public keys, such as an RSA key where the public exponent is zero, which is arithmetically invalid. Because the CERT payload is processed as part of IKE handshake initiation, this code path is reached before peer authentication, making it accessible without any credentials. Both IKEv1 and IKEv2 code paths are affected.
Know when Libreswan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:N/PR:N because CERT payload is processed pre-authentication over the network; AC:L since once FIPS+CA prerequisites exist, sending a crafted cert requires no additional complexity.
Primary rating from Vendor (libreswan).
CVSS VectorVendor: libreswan
DescriptionCVE.org
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.
Executive ViewAI
Libreswan VPN services are vulnerable to unauthenticated remote denial of service attacks that can repeatedly crash the pluto IKE daemon, disrupting VPN connectivity for remote workers and branch offices. An attacker can trigger the vulnerability by sending a malformed X.509 certificate during IKE handshake, forcing service restarts and degrading organizational network resilience. This affects any deployment of Libreswan and requires immediate patching to restore stable VPN operations.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. Rated high severity (CVSS 7.5), this vuln
Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS pa
The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a de
Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transfor
programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers t
libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon re
Denial of service in the Libreswan IPsec VPN's pluto daemon allows remote unauthenticated attackers to crash and repeate
pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticat
A vulnerability was found in the libreswan library. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unau
An issue was discovered in Libreswan 3.x and 4.x before 4.12. Rated medium severity (CVSS 6.5), this vulnerability is re
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB