CVE-2026-50722: CWE-347: Improper Verification of Cryptographic Signature in The Libreswan Project libreswan
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.
AI Analysis
Technical Summary
The Libreswan project has a vulnerability (CVE-2026-50722) in the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa() where the DER encoding of the ASN.1 digest is improperly verified for IKEv2 AUTH payloads using RSASSA-PKCS1-v1_5 as per RFC 8017. This improper verification enables a Bleichenbacher-style attack when small public exponents like e=3 are used, allowing an attacker to forge the AUTH payload and impersonate a peer. Furthermore, encoding a shorter-than-expected hash in the AUTH payload triggers an assertion failure causing the daemon to abort and restart, leading to sustained denial-of-service conditions. The vulnerability does not allow remote code execution and does not affect X.509 certificate verification of the remote IKE peer.
Potential Impact
An attacker can impersonate a remote peer by forging the IKEv2 AUTH payload when small public exponents are used, compromising authentication integrity. Additionally, the vulnerability can be exploited to cause denial-of-service by crashing the daemon repeatedly. There is no impact on confidentiality or remote code execution, and X.509 certificate verification is unaffected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider avoiding configurations that use small public exponents (e.g., e=3) for RSA keys in IKEv2 AUTH payloads. Monitor for updates from the Libreswan project regarding an official fix.
CVE-2026-50722: CWE-347: Improper Verification of Cryptographic Signature in The Libreswan Project libreswan
Description
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Libreswan project has a vulnerability (CVE-2026-50722) in the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa() where the DER encoding of the ASN.1 digest is improperly verified for IKEv2 AUTH payloads using RSASSA-PKCS1-v1_5 as per RFC 8017. This improper verification enables a Bleichenbacher-style attack when small public exponents like e=3 are used, allowing an attacker to forge the AUTH payload and impersonate a peer. Furthermore, encoding a shorter-than-expected hash in the AUTH payload triggers an assertion failure causing the daemon to abort and restart, leading to sustained denial-of-service conditions. The vulnerability does not allow remote code execution and does not affect X.509 certificate verification of the remote IKE peer.
Potential Impact
An attacker can impersonate a remote peer by forging the IKEv2 AUTH payload when small public exponents are used, compromising authentication integrity. Additionally, the vulnerability can be exploited to cause denial-of-service by crashing the daemon repeatedly. There is no impact on confidentiality or remote code execution, and X.509 certificate verification is unaffected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider avoiding configurations that use small public exponents (e.g., e=3) for RSA keys in IKEv2 AUTH payloads. Monitor for updates from the Libreswan project regarding an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- libreswan
- Date Reserved
- 2026-06-05T16:10:05.751Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a46e0f527e9c797192f76b0
Added to database: 07/02/2026, 22:06:45 UTC
Last enriched: 07/02/2026, 22:21:18 UTC
Last updated: 07/02/2026, 22:51:39 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.