Red Hat Security Advisory: libreswan security update

Libreswan, used for IPsec and IKE on Linux, contains several denial of service vulnerabilities: CVE-2026-50721 and CVE-2026-50722 involve denial of service via RSA-SHA1 (PKCS#1 v1.5) authentication payloads in IKEv1 and IKEv2 respectively. CVE-2026-12413 is a denial of service vulnerability caused by malformed fragmentation in IKEv2. Additionally, CVE-2026-14957 allows an attacker to crash the libreswan daemon via a badly formatted X.509 certificate causing an assertion failure. These issues can disrupt VPN tunnels by crashing or denying service to the libreswan daemon. Red Hat has released an update for Red Hat Enterprise Linux 8 to address these vulnerabilities.

Successful exploitation of these vulnerabilities can cause denial of service conditions by crashing or disrupting the libreswan daemon, which manages IPsec VPN tunnels. This can lead to loss of secure network connectivity and potential interruption of services relying on VPN tunnels. There is no indication of code execution or data disclosure from the provided information.

Red Hat has released security updates for libreswan in Red Hat Enterprise Linux 8, specifically versions prior to 8.10.6. Users should apply the official Red Hat update to remediate these vulnerabilities. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.