CVE-2026-50721

Name of the Vulnerable Software and Affected Versions Libreswan (affected versions not specified)

Description Libreswan fails to correctly verify the authentication hash length when the SIG payload of an IKEv1 packet is encoded using PKCS #1 RSA Encryption. This occurs within the RSA authenticate hash signature raw rsa() function. A remote attacker can exploit this using a variation of the Bleichenbacher attack—a cryptographic attack targeting RSA encryption—to forge the SIG payload when small public exponents (such as e=3) are used, potentially leading to impersonation. Furthermore, by encoding a hash shorter than expected in the SIG payload, a remote attacker can trigger an assertion that causes the daemon to abort and restart, resulting in a sustained denial-of-service. Remote code execution is not possible, and X.509 certificate verifications of remote IKE peers remain unaffected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.