IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload
Summary
| CVE | CVE-2026-50721 |
|---|---|
| State | PUBLISHED |
| Assigner | libreswan |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-02 22:16:43 UTC |
| Updated | 2026-07-09 15:46:40 UTC |
| Description | Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected. |
Risk And Classification
Primary CVSS: v3.1 5.9 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.003920000 probability, percentile 0.312880000 (date 2026-07-13)
Problem Types: CWE-347 | CWE-617 | CWE-347 CWE-347: Improper Verification of Cryptographic Signature | CWE-617 CWE-617: Reachable Assertion
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | d42dc95b-23f1-4e06-9076-20753a0fb0df | Secondary | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | The Libreswan Project | Libreswan | affected 5.3 semver | Not specified |
| CNA | The Libreswan Project | Libreswan | unaffected 5.3.1 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.rfc-editor.org/rfc/rfc2313 | d42dc95b-23f1-4e06-9076-20753a0fb0df | www.rfc-editor.org | Technical Description |
| libreswan.org/security/CVE-2026-50721 | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | Vendor Advisory |
| libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | Vendor Advisory |
| libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Yeonghyeon Choi (en)
CNA: Duyeong Kim (en)
CNA: Andrew Cagney (The Libreswan Team) (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-03-24T00:00:00.000Z | Libreswan notified of the issue via [email protected] |
| CNA | 2026-06-16T00:00:00.000Z | Advanced notice given to supported customers and distributions |
| CNA | 2026-06-24T00:00:00.000Z | Public announcement and release of libreswan 5.3.1 |
Solutions
CNA: Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50721/
Workarounds
CNA: IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where authby=ecdsa or authby=rsa-sha2 can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via authby=secret after coordination with the remote peer.
Exploits
CNA: No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv1 configuration using the default authby=rsasig option.