The vulnerability in Libreswan (CVE-2026-50721) arises from improper verification of the authentication hash length in the RSA_authenticate_hash_signature_raw_rsa() function when processing IKEv1 SIG payloads encoded using PKCS #1 RSA Encryption (RFC 2313). Attackers can exploit this by using a variant of the Bleichenbacher attack against implementations using small public exponents (such as e=3) to forge signature payloads, enabling impersonation attacks. Additionally, crafting a SIG payload with a shorter than expected hash triggers an assertion failure causing the daemon to abort and restart, leading to sustained denial of service. The vulnerability does not affect remote code execution capabilities or X.509 certificate verification of IKE peers.

An attacker can impersonate legitimate IKEv1 peers by forging SIG payloads due to improper signature verification, compromising authentication integrity. Furthermore, the vulnerability can be leveraged to cause a denial of service by repeatedly crashing the daemon through malformed SIG payloads. There is no impact on confidentiality or remote code execution, and X.509 certificate verification remains secure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider mitigating exposure by avoiding use of small public exponents (e.g., e=3) in RSA keys if configurable, and monitor for abnormal daemon restarts. No official patch or workaround is currently documented.