The Libreswan project has a cryptographic signature verification vulnerability (CVE-2026-50721) in versions up to 5.3. The function RSA_authenticate_hash_signature_raw_rsa() does not correctly verify the length of the authentication hash when processing IKEv1 SIG payloads encoded using PKCS #1 RSA Encryption (RFC 2313). This improper verification enables a remote attacker to perform a variant of the Bleichenbacher attack when small public exponents like e=3 are used, allowing forgery of the SIG payload and potential impersonation. Furthermore, an attacker can send a shorter hash than expected to trigger an assertion failure, causing the daemon to abort and restart, leading to sustained denial of service. The vulnerability does not affect X.509 certificate verification and does not allow remote code execution.

An attacker can remotely forge SIG payloads in IKEv1 packets under certain conditions, potentially impersonating legitimate peers. Additionally, the vulnerability can be exploited to cause a denial of service by repeatedly crashing and restarting the Libreswan daemon. There is no impact on confidentiality or integrity of data beyond impersonation, and remote code execution is not possible. X.509 certificate verification is unaffected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider avoiding use of small public exponents (e.g., e=3) in RSA keys used with Libreswan. Monitor for updates from the Libreswan project regarding an official fix or workaround.