Libreswan CVE-2026-50722

For the impersonation/forgery path, the required condition is that the authenticating peer uses IKEv2 AUTH with RSASSA-PKCS1-v1_5 raw RSA signatures AND an RSA key with a small public exponent such as e=3 - this non-default key configuration is the exact prerequisite and the primary limiting factor (modern keys typically use e=65537, which is not vulnerable to the low-exponent forgery). The attack requires network reach to the IKE listener (UDP/500 or UDP/4500) and is unauthenticated (PR:N), with high complexity (AC:H). For the denial-of-service path, the only prerequisite is the ability to send a crafted IKEv2 AUTH payload with a shorter-than-expected hash to the daemon; no small-exponent key is needed, making it broadly reachable but limited to service disruption (daemon abort/restart) rather than compromise. X.509 certificate-based peer verification is not exploitable via this flaw.

The NVD CVSS 3.1 score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) reflecting the cryptographic conditions and math required. The impersonation impact is gated on the target/peer using a small public exponent such as e=3, which is a non-default and increasingly uncommon key configuration - this materially lowers real-world exploitability for the forgery path and justifies AC:H. The DoS path (short hash → assertion → daemon abort/restart) is far more broadly reachable and requires no special key configuration, making availability the most realistic mass-impact vector. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation; treat this as a serious cryptographic authentication bypass to patch promptly on internet-facing IKE endpoints rather than a confirmed in-the-wild threat. Note the tags include 'RCE' and 'Jwt Attack', but the description explicitly states remote code execution is not possible and the attack is a PKCS#1 v1.5 (not JWT) signature-forgery - treat those tags as inaccurate.

An attacker who can reach the victim's IKEv2 endpoint initiates an IKE_AUTH exchange and submits a forged RSASSA-PKCS1-v1_5 AUTH payload; if the peer key uses a small exponent like e=3, the lax DER parser accepts the crafted signature and the attacker impersonates a trusted peer to establish a VPN tunnel. Alternatively, the attacker repeatedly sends AUTH payloads containing a shorter-than-expected hash, tripping an assertion that aborts the daemon on each attempt for a sustained denial of service. No public exploit code was identified, and the forgery path's high complexity (AC:H) reflects the non-default e=3 requirement.