What is the CVSS score of CVE-2026-50722?

CVE-2026-50722 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Libreswan are affected by CVE-2026-50722?

Libreswan, a widely-deployed IPsec implementation, contains a flaw in RSA signature verification that permits unauthenticated remote attackers to either forge authentication credentials to…. A patch is available.

How to fix or mitigate CVE-2026-50722?

Within 24 hours: Identify all Libreswan deployments in your infrastructure; document current versions; retrieve the vendor advisory for CVE-2026-50722 to identify the patched version and release date. Within 7 days: Apply vendor-released patch to a test/staging environment; conduct regression testing of VPN peer authentication, throughput, and interoperability; document baseline and post-patch metrics. Within 30 days: Deploy the patched Libreswan version to all production VPN gateways, client endpoints, and related systems; monitor for authentication or connectivity anomalies during and after deployment; verify all configured peer connections re-establish successfully.

Libreswan CVE-2026-50722

EUVD-2026-41440 MEDIUM

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-02 libreswan

GHSA-h4cv-5vw8-2p6m

Jwt Attack Denial Of Service RCE Libreswan Red Hat Suse

5.9

CVSS 3.1 · NVD

Temporal: 7.5

Severity by source

Vendor (libreswan) PRIMARY

HIGH

qualitative

NVD

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CIRCL (temporal)

7.5 HIGH

cvss

vuln.today AI

8.1 HIGH

Network-reachable and unauthenticated (PR:N); forgery needs the non-default small-exponent condition, giving AC:H; impersonation yields C:H/I:H and daemon-abort DoS gives A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 MEDIUM

qualitative

Primary rating from Vendor (libreswan).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 15:52 NVD

HIGH MEDIUM

CVSS changed

Jul 09, 2026 - 15:52 NVD

8.1 (HIGH) 5.9 (MEDIUM)

Analysis Updated

Jul 02, 2026 - 22:30 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 22:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Jul 02, 2026 - 22:22 NVD

7.5 (HIGH) 8.1 (HIGH)

Analysis Generated

Jul 02, 2026 - 22:16 vuln.today

DescriptionNVD

Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.

AnalysisAI

Peer impersonation and denial-of-service in Libreswan IPsec/IKEv2 arises from improper DER/ASN.1 digest verification in RSA_authenticate_hash_signature_pkcs1_1_5_rsa() when the IKEv2 AUTH payload uses RSASSA-PKCS1-v1_5 signatures. A remote unauthenticated attacker can mount a Bleichenbacher-style forgery to impersonate a peer when small RSA public exponents (e.g., e=3) are in use, or send an undersized hash to trip an assertion that aborts and restarts the daemon for sustained DoS. A vendor patch is available and there is no public exploit identified at time of analysis; RCE is not possible and X.509 certificate verification of the peer is unaffected.

Technical ContextAI

Libreswan is an open-source IKE/IPsec VPN daemon (a Openswan/FreeS/WAN descendant) widely used on Linux to establish IKEv2 security associations. The flaw is in its verification of RSASSA-PKCS1-v1_5 signatures (RFC 8017 / PKCS#1 v1.5) carried in the IKEv2 AUTH payload during peer authentication. The root cause maps to CWE-347 (Improper Verification of Cryptographic Signature): the code failed to strictly validate the DER encoding of the ASN.1 DigestInfo structure wrapping the hash, allowing extra bytes to be smuggled around the hash. This is the classic precondition for a Bleichenbacher low-exponent signature-forgery attack, where a cube-root can be crafted into a value that passes a lax parser as a valid e=3 signature. The affected component is only the raw-RSA-signature AUTH path; the separate X.509 certificate chain verification of the remote peer is explicitly not affected.

RemediationAI

Apply the vendor-released Libreswan patch published at https://libreswan.org/security/CVE-2026-50722/ and detailed in the advisory https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt (upgrade to the fixed release once the exact version is confirmed from that advisory, as the input does not name a specific fix version). Until patched, mitigate the impersonation path by avoiding small RSA public exponents (do not use e=3 keys; use e=65537) and, where feasible, migrate peer authentication from raw RSASSA-PKCS1-v1_5 signatures to X.509 certificate-based authentication (unaffected) or to stronger signature schemes - with the trade-off of coordinated configuration changes on both peers. For the DoS path, restrict IKE reachability by firewalling UDP/500 and UDP/4500 to known VPN peer addresses so untrusted hosts cannot send crafted AUTH payloads, accepting that this only helps where peer IPs are predictable; monitor and auto-restart the daemon (e.g., via systemd) as a stopgap, noting it does not stop sustained abort loops.