CVE-2026-14957: CWE-617: Reachable Assertion in The Libreswan Project libreswan
Description
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.
CVSS v3.1
Score 7.5high
Affected software
The Libreswan Project
libreswan
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Libreswan running in FIPS mode, the add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts the result is not NULL. CERT_ExtractPublicKey() returns NULL if public key extraction fails, such as when the RSA exponent is zero. A remote attacker can exploit this by sending a malformed X.509 certificate in a CERT payload, triggering the assertion failure and causing the pluto daemon to abort and restart repeatedly, resulting in denial of service. This affects both IKEv1 and IKEv2. Exploitation requires FIPS mode enabled on both OS and Libreswan and at least one CA certificate loaded in the NSS database. The CERT payload is processed before peer authentication, so no credentials are needed. Configurations using only PreSharedKey authentication without CA certificates are not vulnerable.
Potential Impact
The vulnerability causes a denial of service by repeatedly crashing and restarting the pluto daemon when processing a malformed X.509 certificate in a CERT payload. There is no impact on confidentiality or integrity, and no remote code execution is possible. The denial of service affects availability of the VPN service using Libreswan in FIPS mode with CA certificates loaded.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running Libreswan in FIPS mode with CA certificates loaded if possible. Configurations using only PreSharedKey authentication without CA certificates are not vulnerable. Monitoring for malformed CERT payloads and restricting untrusted certificate inputs may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- libreswan
- Date Reserved
- 2026-07-07T13:39:23.932Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a978f78acd9273b49a87e2d
Added to database: 09/02/2026, 02:52:40 UTC
Last enriched: 09/07/2026, 13:58:42 UTC
Last updated: 10/15/2026, 06:48:14 UTC
Views: 94
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.