IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload
Summary
| CVE | CVE-2026-50722 |
|---|---|
| State | PUBLISHED |
| Assigner | libreswan |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-02 22:16:43 UTC |
| Updated | 2026-07-09 15:47:00 UTC |
| Description | Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected. |
Risk And Classification
Primary CVSS: v3.1 5.9 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.003520000 probability, percentile 0.272930000 (date 2026-07-13)
Problem Types: CWE-347 | CWE-617 | CWE-347 CWE-347: Improper Verification of Cryptographic Signature | CWE-617 CWE-617: Reachable Assertion
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | d42dc95b-23f1-4e06-9076-20753a0fb0df | Secondary | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 8.1 | HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | The Libreswan Project | Libreswan | affected 5.3 semver | Not specified |
| CNA | The Libreswan Project | Libreswan | unaffected 5.3.1 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.rfc-editor.org/rfc/rfc8017 | d42dc95b-23f1-4e06-9076-20753a0fb0df | www.rfc-editor.org | Technical Description |
| libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | Vendor Advisory |
| libreswan.org/security/CVE-2026-50722 | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | Vendor Advisory |
| libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt | d42dc95b-23f1-4e06-9076-20753a0fb0df | libreswan.org | Vendor Advisory, Mailing List |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Yeonghyeon Choi (en)
CNA: Duyeong Kim (en)
CNA: Andrew Cagney (The Libreswan Team) (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-03-24T00:00:00.000Z | Libreswan notified of the issue via [email protected] |
| CNA | 2026-06-16T00:00:00.000Z | Advanced notice given to supported customers and distributions |
| CNA | 2026-06-24T00:00:00.000Z | Public announcement and release of libreswan 5.3.1 |
Solutions
CNA: Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/
Workarounds
CNA: If Windows support is not needed, configure authby=ecdsa or authby=rsa-sha2 (or both via authby=ecdsa,rsa-sha2) to disallow the fallback of RSA PKCS#1 1.5. The leftauth= and rightauth= settings can be updated similarly if those are in use instead of authby.
Exploits
CNA: No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv2 configuration using default authby= settings that permit RSA PKCS#1 v1.5 fallback.