Red Hat Security Advisory: libreswan security update
Multiple denial of service vulnerabilities and a crash issue have been identified in libreswan, an IPsec and IKE implementation for Linux. These include IKEv1 and IKEv2 denial of service via RSA-SHA1 authentication payloads, malformed fragmentation in IKEv2, and an assertion failure caused by badly formatted X.509 certificates. These issues can cause the libreswan daemon to crash, disrupting VPN services. Red Hat has issued a security advisory with updates to address these vulnerabilities for Red Hat Enterprise Linux Fast Datapath 9 on various architectures.
AI Analysis
Technical Summary
Libreswan, a Linux implementation of IPsec and IKE, is affected by four security issues: CVE-2026-50721 and CVE-2026-50722 describe denial of service vulnerabilities in IKEv1 and IKEv2 respectively, triggered by RSA-SHA1 (PKCS#1 v1.5) authentication payloads. CVE-2026-12413 is an IKEv2 denial of service via malformed fragmentation. CVE-2026-14957 involves an assertion failure caused by a badly formatted X.509 certificate, leading to a daemon crash. These vulnerabilities can disrupt VPN tunnels by crashing the libreswan daemon. Red Hat has released updated libreswan packages (version 5.3.2-1.el9fdp) for Red Hat Enterprise Linux Fast Datapath 9 across multiple architectures to fix these issues.
Potential Impact
Successful exploitation of these vulnerabilities results in denial of service conditions by crashing the libreswan daemon, which can interrupt IPsec VPN tunnels and related secure communications. There is no indication of remote code execution or data disclosure. The impact is primarily service disruption.
Mitigation Recommendations
Red Hat has released updated libreswan packages (version 5.3.2-1.el9fdp) for Red Hat Enterprise Linux Fast Datapath 9 on x86_64, ppc64le, s390x, and aarch64 architectures. Applying these official updates will remediate the vulnerabilities. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to update their systems promptly. No alternative mitigations or workarounds are specified.
Red Hat Security Advisory: libreswan security update
Description
Multiple denial of service vulnerabilities and a crash issue have been identified in libreswan, an IPsec and IKE implementation for Linux. These include IKEv1 and IKEv2 denial of service via RSA-SHA1 authentication payloads, malformed fragmentation in IKEv2, and an assertion failure caused by badly formatted X.509 certificates. These issues can cause the libreswan daemon to crash, disrupting VPN services. Red Hat has issued a security advisory with updates to address these vulnerabilities for Red Hat Enterprise Linux Fast Datapath 9 on various architectures.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Libreswan, a Linux implementation of IPsec and IKE, is affected by four security issues: CVE-2026-50721 and CVE-2026-50722 describe denial of service vulnerabilities in IKEv1 and IKEv2 respectively, triggered by RSA-SHA1 (PKCS#1 v1.5) authentication payloads. CVE-2026-12413 is an IKEv2 denial of service via malformed fragmentation. CVE-2026-14957 involves an assertion failure caused by a badly formatted X.509 certificate, leading to a daemon crash. These vulnerabilities can disrupt VPN tunnels by crashing the libreswan daemon. Red Hat has released updated libreswan packages (version 5.3.2-1.el9fdp) for Red Hat Enterprise Linux Fast Datapath 9 across multiple architectures to fix these issues.
Potential Impact
Successful exploitation of these vulnerabilities results in denial of service conditions by crashing the libreswan daemon, which can interrupt IPsec VPN tunnels and related secure communications. There is no indication of remote code execution or data disclosure. The impact is primarily service disruption.
Mitigation Recommendations
Red Hat has released updated libreswan packages (version 5.3.2-1.el9fdp) for Red Hat Enterprise Linux Fast Datapath 9 on x86_64, ppc64le, s390x, and aarch64 architectures. Applying these official updates will remediate the vulnerabilities. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to update their systems promptly. No alternative mitigations or workarounds are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:46986
- Cve Count
- 4
- Additional Cves
- ["CVE-2026-14957","CVE-2026-50721","CVE-2026-50722"]
- Cvss Version
- null
Threat ID: 6a885f13acd9273b493f77d8
Added to database: 08/21/2026, 14:22:11 UTC
Last enriched: 08/21/2026, 14:24:14 UTC
Last updated: 08/22/2026, 03:51:58 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.