Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-50722
PUBLISHED
More InfoOfficial Page
Assigner-libreswan
Assigner Org ID-d42dc95b-23f1-4e06-9076-20753a0fb0df
View Known Exploited Vulnerability (KEV) details
Published At-02 Jul, 2026 | 21:34
Updated At-02 Jul, 2026 | 21:34
Rejected At-
▼CVE Numbering Authority (CNA)
IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload

Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.

Affected Products
Vendor
The Libreswan Project
Product
libreswan
Collection URL
https://github.com/libreswan/libreswan
Package Name
libreswan
Repo
https://github.com/libreswan/libreswan
Program Routines
  • RSA_authenticate_hash_signature_pkcs1_1_5_rsa
Default Status
unaffected
Versions
Affected
  • From 0 through 5.3 (semver)
Unaffected
  • 5.3.1 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-347CWE-347: Improper Verification of Cryptographic Signature
CWECWE-617CWE-617: Reachable Assertion
Type: CWE
CWE ID: CWE-347
Description: CWE-347: Improper Verification of Cryptographic Signature
Type: CWE
CWE ID: CWE-617
Description: CWE-617: Reachable Assertion
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.18.1HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
vendorSeverity
value:
MEDIUM
description:
Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart.
Impacts
CAPEC IDDescription
CAPEC-463Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 AUTH payloads
CAPEC-473Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use
CAPEC ID: CAPEC-463
Description: Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 AUTH payloads
CAPEC ID: CAPEC-473
Description: Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use
Solutions

Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/

Configurations

Any server or client that accepts RSA-based IKEv2 connections via the default authby= settings is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv2 by default allows ECDSA, RSA-SSA-PSS, and RSA PKCS#1 1.5 as fallback due to Microsoft Windows not supporting RSASSA-PSS.

Workarounds

If Windows support is not needed, configure authby=ecdsa or authby=rsa-sha2 (or both via authby=ecdsa,rsa-sha2) to disallow the fallback of RSA PKCS#1 1.5. The leftauth= and rightauth= settings can be updated similarly if those are in use instead of authby.

Exploits

No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv2 configuration using default authby= settings that permit RSA PKCS#1 v1.5 fallback.

Credits
finder
Yeonghyeon Choi
finder
Duyeong Kim
analyst
Andrew Cagney (The Libreswan Team)
Timeline
EventDate
Libreswan notified of the issue via security@libreswan.org2026-03-24 00:00:00
Advanced notice given to supported customers and distributions2026-06-16 00:00:00
Public announcement and release of libreswan 5.3.12026-06-24 00:00:00
Event: Libreswan notified of the issue via security@libreswan.org
Date: 2026-03-24 00:00:00
Event: Advanced notice given to supported customers and distributions
Date: 2026-06-16 00:00:00
Event: Public announcement and release of libreswan 5.3.1
Date: 2026-06-24 00:00:00
Replaced By
Rejected Reason
References
HyperlinkResource
https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt
vendor-advisory
https://libreswan.org/security/CVE-2026-50722/
patch
https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt
related
https://www.rfc-editor.org/rfc/rfc8017
technical-description
Hyperlink: https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt
Resource:
vendor-advisory
Hyperlink: https://libreswan.org/security/CVE-2026-50722/
Resource:
patch
Hyperlink: https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt
Resource:
related
Hyperlink: https://www.rfc-editor.org/rfc/rfc8017
Resource:
technical-description
Details not found