FIPS mode assertion failure via malicious CERT payload
Summary
| CVE | CVE-2026-14957 |
|---|---|
| State | PUBLISHED |
| Assigner | libreswan |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-02 03:16:47 UTC |
| Updated | 2026-09-02 03:16:47 UTC |
| Description | In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from d42dc95b-23f1-4e06-9076-20753a0fb0df
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Problem Types: CWE-252 | CWE-617 | CWE-617 CWE-617: Reachable Assertion | CWE-252 CWE-252: Unchecked Return Value
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | d42dc95b-23f1-4e06-9076-20753a0fb0df | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | The Libreswan Project | Libreswan | affected 3.0 5.3.1 semver | Not specified |
| CNA | The Libreswan Project | Libreswan | unaffected 5.3.2 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | |
| libreswan.org/security/CVE-2026-14957 | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Claude (Anthropic) (en)
CNA: Guillaume Winter (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-06-17T00:00:00.000Z | Guillaume Winter shared a Claude audit review |
| CNA | 2026-07-09T00:00:00.000Z | Advanced notice given to supported customers and distributions |
| CNA | 2026-07-15T00:00:00.000Z | Public announcement and release of libreswan 5.3.2 |
Solutions
CNA: Upgrade to libreswan 5.3.2 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-14957/
Workarounds
CNA: No workaround is available unless one is willing to disable FIPS mode. If libreswan is only using PreSharedKey (PSK) authentication and the NSS database contains no CA certificates, CERT payloads are ignored and libreswan is not vulnerable.
Exploits
CNA: No known exploitation in the wild. Exploitation requires the target to be running in FIPS mode with at least one CA certificate loaded. The CERT payload can be sent before peer authentication, so no credentials are needed.