The Libreswan project has a vulnerability (CVE-2026-50722) in the RSA_authenticate_hash_signature_pkcs1_1_5_rsa() function where the DER encoding of the ASN.1 digest is not properly verified for IKEv2 AUTH payloads using RSASSA-PKCS1-v1_5. This improper verification enables a remote attacker to exploit a variant of the Bleichenbacher attack, particularly when small public exponents such as e=3 are used, to forge authentication payloads and impersonate peers. Furthermore, an attacker can send an AUTH payload with a shorter-than-expected hash, triggering an assertion failure that causes the daemon to abort and restart, leading to sustained denial-of-service conditions. The vulnerability does not allow remote code execution and does not affect X.509 certificate verification of remote IKE peers.

An attacker can impersonate a remote peer by forging authentication payloads due to improper signature verification, potentially compromising authentication integrity. Additionally, the vulnerability can be exploited to cause a denial-of-service by repeatedly crashing the daemon through malformed AUTH payloads. There is no impact on confidentiality or remote code execution, and X.509 certificate verification remains secure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider mitigating risk by avoiding configurations that use small public exponents (e.g., e=3) for RSA keys in IKEv2 AUTH payloads. Monitor for daemon crashes and apply any vendor-provided updates once released.