EUVD-2026-41441
GHSA-93pj-2pmf-2x7p
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 02, 2026
Signature forgery and denial-of-service in Libreswan's IKEv1 RSA authentication allows a remote unauthenticated attacker to impersonate an IKE peer or crash the daemon. The flaw lives in RSA_authenticate_hash_signature_raw_rsa(), which fails to validate the length of the authentication hash inside a PKCS #1 (RFC 2313) encoded SIG payload; when a peer uses a small RSA public exponent such as e=3, a Bleichenbacher-style forgery becomes feasible. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the impersonation impact against IKEv1 raw-RSA authentication makes this a high-severity issue (CVSS 8.1); remote code execution is explicitly not possible and X.509 certificate verification is unaffected.
Earlier versions of this analysis (2)
Signature-verification bypass in Libreswan's IKEv1 daemon lets remote attackers forge RSA-signed SIG payloads and impersonate IKE peers, or crash the daemon for denial of service. The flaw lives in RSA_authenticate_hash_signature_raw_rsa(), which fails to validate the authentication-hash length for PKCS #1 (RFC 2313) encoded signatures, enabling a Bleichenbacher-style forgery when peers use small RSA public exponents such as e=3. No public exploit is identified at time of analysis and the issue is not in CISA KEV, but it is unauthenticated and network-reachable; RCE is not possible and X.509 certificate verification is unaffected.
Denial-of-service and cryptographic impersonation in Libreswan's IKEv1 RSA authentication arise because RSA_authenticate_hash_signature_raw_rsa() fails to validate the length of the authentication hash in a PKCS #1 (RFC 2313) encoded SIG payload. Remote unauthenticated attackers can send a crafted IKEv1 packet with an undersized hash to trigger an assertion that aborts the daemon (which then restarts, enabling sustained DoS), and where peers use small RSA public exponents such as e=3 a Bleichenbacher-style signature forgery permits peer impersonation. There is no public exploit identified at time of analysis, no CISA KEV listing, and remote code execution is explicitly ruled out; X.509 certificate verification is unaffected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Libreswan gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (libreswan).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.
Executive ViewAI
Libreswan deployments face a critical authentication bypass vulnerability in their IKEv1 protocol stack (CVE-2026-50721, CVSS 8.1) that could allow adversaries to hijack encrypted connections without detection; no public exploit identified at time of analysis. Organizations operating Libreswan-based VPN infrastructure should treat this as a potential man-in-the-middle risk against their network perimeter security, though X.509 certificate pinning policies provide a secondary control layer.
Within 24 hours: Inventory all systems running Libreswan and document current version and IKEv1 configuration status, particularly any deployments using raw-RSA authentication. Within 7 days: Apply the vendor-released patch to all affected Libreswan installations. Within 30 days: Verify patch deployment across the entire infrastructure footprint and enable enhanced logging of IKE negotiations to detect any anomalous authentication attempts.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has
In Libreswan 3.27 an assertion failure can lead to a pluto IKE daemon restart. Rated high severity (CVSS 7.5), this vuln
Libreswan 4.9 allows remote attackers to cause a denial of service (assert failure and daemon restart) via crafted TS pa
The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a de
Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes_xcbc transfor
programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers t
libreswan before 3.18 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto daemon re
Denial of service in the Libreswan IPsec VPN's pluto daemon allows remote unauthenticated attackers to crash and repeate
Unauthenticated remote denial of service in Libreswan's pluto IKE daemon allows any network attacker to repeatedly crash
pluto in Libreswan before 4.11 allows a denial of service (responder SPI mishandling and daemon crash) via unauthenticat
A vulnerability was found in the libreswan library. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unau
Vendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB