Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.
"}],"value":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected."}],"exploits":[{"lang":"en","value":"No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv2 configuration using default authby= settings that permit RSA PKCS#1 v1.5 fallback."}],"impacts":[{"capecId":"CAPEC-463","descriptions":[{"lang":"en","value":"Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 AUTH payloads"}]},{"capecId":"CAPEC-473","descriptions":[{"lang":"en","value":"Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"}]},{"other":{"content":{"description":"Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart.","value":"MEDIUM"},"type":"vendorSeverity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-347","description":"CWE-347: Improper Verification of Cryptographic Signature","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-617","description":"CWE-617: Reachable Assertion","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-02T21:34:41.413Z","orgId":"d42dc95b-23f1-4e06-9076-20753a0fb0df","shortName":"libreswan"},"references":[{"name":"Libreswan Security Advisory CVE-2026-50722","tags":["vendor-advisory"],"url":"https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt"},{"name":"Libreswan CVE-2026-50722 Patches","tags":["patch"],"url":"https://libreswan.org/security/CVE-2026-50722/"},{"name":"Related: CVE-2026-50721 (IKEv1 variant)","tags":["related"],"url":"https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt"},{"name":"RFC 8017 - PKCS #1: RSA Cryptography Specifications Version 2.2","tags":["technical-description"],"url":"https://www.rfc-editor.org/rfc/rfc8017"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/
"}],"value":"Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/"}],"source":{"defects":["CVE-2026-50722"],"discovery":"EXTERNAL"},"taxonomyMappings":[{"taxonomyName":"ATT&CK","taxonomyRelations":[{"relationshipName":"maps to","relationshipValue":"Application or System Exploitation (DoS)","taxonomyId":"T1499.004"}],"taxonomyVersion":"15.1"}],"timeline":[{"lang":"en","time":"2026-03-24T00:00:00.000Z","value":"Libreswan notified of the issue via security@libreswan.org"},{"lang":"en","time":"2026-06-16T00:00:00.000Z","value":"Advanced notice given to supported customers and distributions"},{"lang":"en","time":"2026-06-24T00:00:00.000Z","value":"Public announcement and release of libreswan 5.3.1"}],"title":"IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"If Windows support is not needed, configure authby=ecdsa or authby=rsa-sha2 (or both via authby=ecdsa,rsa-sha2) to disallow the fallback of RSA PKCS#1 1.5. The leftauth= and rightauth= settings can be updated similarly if those are in use instead of authby.