What is the CVSS score of CVE-2026-50721?

CVE-2026-50721 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Jwt Attack are affected by CVE-2026-50721?

Libreswan deployments face a critical authentication bypass vulnerability in their IKEv1 protocol stack (CVE-2026-50721, CVSS 8.1) that could allow adversaries to hijack encrypted connections without…. A patch is available.

How to fix or mitigate CVE-2026-50721?

Within 24 hours: Inventory all systems running Libreswan and document current version and IKEv1 configuration status, particularly any deployments using raw-RSA authentication. Within 7 days: Apply the vendor-released patch to all affected Libreswan installations. Within 30 days: Verify patch deployment across the entire infrastructure footprint and enable enhanced logging of IKE negotiations to detect any anomalous authentication attempts.

Jwt Attack CVE-2026-50721

EUVD-2026-41441 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-02 libreswan

GHSA-93pj-2pmf-2x7p

RCE Denial Of Service Jwt Attack Libreswan

8.1

CVSS 3.1 · Vendor: libreswan

Severity by source

Vendor (libreswan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (libreswan) · only source for this CVE.

CVSS VectorVendor: libreswan

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 22:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 22:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Jul 02, 2026 - 22:22 NVD

7.5 (HIGH) 8.1 (HIGH)

Analysis Generated

Jul 02, 2026 - 22:16 vuln.today

DescriptionCVE.org

Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.

AnalysisAI

Signature forgery and denial-of-service in Libreswan's IKEv1 RSA authentication allows a remote unauthenticated attacker to impersonate an IKE peer or crash the daemon. The flaw lives in RSA_authenticate_hash_signature_raw_rsa(), which fails to validate the length of the authentication hash inside a PKCS #1 (RFC 2313) encoded SIG payload; when a peer uses a small RSA public exponent such as e=3, a Bleichenbacher-style forgery becomes feasible. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Inventory all systems running Libreswan and document current version and IKEv1 configuration status, particularly any deployments using raw-RSA authentication. …

Threat intelligence, references, and detailed analysis are available after sign-in.