Red Hat Security Advisory: libreswan security update
Multiple denial of service vulnerabilities and a crash issue have been identified in Libreswan, an IPsec and IKE implementation for Linux. These include IKEv1 and IKEv2 denial of service via RSA-SHA1 authentication payloads, malformed fragmentation in IKEv2, and an assertion failure triggered by badly formatted X.509 certificates. Red Hat has issued a security advisory with an update for Red Hat Enterprise Linux 8 to address these issues.
AI Analysis
Technical Summary
Libreswan, used for IPsec and IKE VPN tunnels on Linux, contains several vulnerabilities that can cause denial of service conditions or daemon crashes. Specifically, CVE-2026-50721 and CVE-2026-50722 describe denial of service via malformed RSA-SHA1 authentication payloads in IKEv1 and IKEv2 respectively. CVE-2026-12413 involves denial of service through malformed fragmentation in IKEv2. CVE-2026-14957 allows a badly formatted X.509 certificate to trigger an assertion failure crashing the daemon process. Red Hat has released updated packages for Red Hat Enterprise Linux 8 to fix these vulnerabilities.
Potential Impact
Successful exploitation of these vulnerabilities can cause denial of service by crashing or disrupting the Libreswan daemon, potentially interrupting VPN services relying on IPsec tunnels. There is no indication of remote code execution or data compromise. The impact is limited to service availability degradation.
Mitigation Recommendations
Red Hat has released updated Libreswan packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the provided security update (RHSA-2026:46396) to remediate the issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation is indicated by the vendor.
Red Hat Security Advisory: libreswan security update
Description
Multiple denial of service vulnerabilities and a crash issue have been identified in Libreswan, an IPsec and IKE implementation for Linux. These include IKEv1 and IKEv2 denial of service via RSA-SHA1 authentication payloads, malformed fragmentation in IKEv2, and an assertion failure triggered by badly formatted X.509 certificates. Red Hat has issued a security advisory with an update for Red Hat Enterprise Linux 8 to address these issues.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Libreswan, used for IPsec and IKE VPN tunnels on Linux, contains several vulnerabilities that can cause denial of service conditions or daemon crashes. Specifically, CVE-2026-50721 and CVE-2026-50722 describe denial of service via malformed RSA-SHA1 authentication payloads in IKEv1 and IKEv2 respectively. CVE-2026-12413 involves denial of service through malformed fragmentation in IKEv2. CVE-2026-14957 allows a badly formatted X.509 certificate to trigger an assertion failure crashing the daemon process. Red Hat has released updated packages for Red Hat Enterprise Linux 8 to fix these vulnerabilities.
Potential Impact
Successful exploitation of these vulnerabilities can cause denial of service by crashing or disrupting the Libreswan daemon, potentially interrupting VPN services relying on IPsec tunnels. There is no indication of remote code execution or data compromise. The impact is limited to service availability degradation.
Mitigation Recommendations
Red Hat has released updated Libreswan packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the provided security update (RHSA-2026:46396) to remediate the issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation is indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:46396
- Cve Count
- 4
- Additional Cves
- ["CVE-2026-14957","CVE-2026-50721","CVE-2026-50722"]
- Cvss Version
- null
Threat ID: 6a885f13acd9273b493f77de
Added to database: 08/21/2026, 14:22:11 UTC
Last enriched: 08/21/2026, 14:24:54 UTC
Last updated: 08/22/2026, 03:51:58 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.