Red Hat Security Advisory: libreswan security update
Description
Multiple denial of service vulnerabilities have been identified in libreswan, an implementation of IPsec and IKE for Linux, affecting Red Hat Enterprise Linux 9. These include issues with RSA-SHA1 authentication payloads in IKEv1 and IKEv2, malformed fragmentation in IKEv2, and a badly formatted X.509 certificate causing assertion failures that crash the daemon process. Red Hat has issued a security update to address these vulnerabilities.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Libreswan, used for IPsec and IKE implementations on Linux, contains several denial of service vulnerabilities. CVE-2026-50721 and CVE-2026-50722 involve denial of service via RSA-SHA1 (PKCS#1 v1.5) authentication payloads in IKEv1 and IKEv2 respectively. CVE-2026-12413 is a denial of service vulnerability caused by malformed fragmentation in IKEv2. CVE-2026-14957 involves an assertion failure triggered by a badly formatted X.509 certificate, crashing the libreswan daemon. These issues can disrupt VPN tunnels by causing service interruptions. Red Hat has released security updates for Red Hat Enterprise Linux 9 to fix these vulnerabilities.
Potential Impact
Successful exploitation of these vulnerabilities can cause denial of service conditions by crashing the libreswan daemon or disrupting IPsec VPN tunnels. This impacts the availability of secure network communications relying on libreswan for IPsec and IKE. There is no indication of remote code execution or data disclosure. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Red Hat has released security updates for libreswan in Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the provided updates as detailed in the Red Hat advisory RHSA-2026:46397. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:46397
- Cve Count
- 4
- Additional Cves
- ["CVE-2026-14957","CVE-2026-50721","CVE-2026-50722"]
- State
- PUBLISHED
Threat ID: 6a885f13acd9273b493f77dc
Added to database: 08/21/2026, 14:22:11 UTC
Last enriched: 09/10/2026, 18:21:13 UTC
Last updated: 10/05/2026, 18:48:16 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.