Libreswan CVE-2026-50722: IKEv2 DoS via malformed PKCS#1.5 signature payload

Vulnerability Overview CVE ID: CVE-2026-50722 Vulnerability Type: IKEv2 Denial of Service Vulnerability Description: When Libreswan receives a malformed PKCS#1.5 signature payload, it triggers an assertion, causing Libreswan to abort and restart. If the RSA key is weak (e.g., e=3), an attacker can forge authentication payloads, leading to a denial of service. Scope of Impact Affected Versions: All versions up to and including 5.3 Unaffected Versions: 5.3.1 and later Remediation Upgrade: Upgrade to Libreswan 5.3.1 or later. Patch: For users unable to upgrade, the following patch is available: - https://libreswan.org/security/CVE-2026-50722/ Exploit Code ```plaintext -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CVE-2026-50722: IKEv2 Denial of Service via RSA-SM1 (PKCS#1 RSA512-PKCS#1-v1.5) authentication payload This alert (and any updates) are available at the following URLs: https://libreswan.org/security/CVE-2026-50722 (See also CVE-2026-50721 which is the IKEv1 variant of this bug) The Libreswan Project was notified of an issue when it receives an invalidly formatted PKCS#1.5 signature payload that authenticates the IKE exchange. The vulnerability is similar to CVE-2018-16151. Use of RSA signatures over certificates during X.509 certificate verifications of the remote IKE peer are not affected by this vulnerability. When the RSA exponent is weak (eg e=3), Bleichenbacher-style signature forgeries are possible, resulting in an authentication bypass. Note that most cryptographic library versions and Libreswan raw RSA key generation have not allowed weak exponents for at least a decade, so valid RSA keys with weak exponents should be very rare. Additionally, the invalid RSA IKE authentication payload can trigger an assertion, resulting in libreswan aborting and restarting. Continued sending of such packets can result in a denial of service. Severity: Medium Vulnerable versions: all version up to and including 5.3 Not vulnerable: 5.3.1 or later Vulnerability details ===================== Libreswan (via the function RSA authenticate hash signature_pkcs1_5_rsa()), did not correctly verify the DER encoding of the RSA1.5 digest when the IKEv2 AUTH payload was encoded using RSA512-PKCS#1-v1.5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are being used, which could lead to impersonation. A remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. Exploitation ============ If a server or client will accept RSA based IKEv2 connections via the default authby settings, an attacker crash cause the denial of service, and while exponents are in use, cause an authentication bypass. Remote code execution is not possible. Workaround ========== IKEv2 by default allows EKD5A, RSA-SSA-PSS (IPSS), and allows RSA PKCS#1 1.5 as fallback due to Microsoft Windows not supporting RSA512-PSS. If Windows support is not needed, one can configure authby=esp or authby=rsa-sha2 (or both via authby=esp,rsa-sha2) to disallow the fallback of RSA PKCS#1 1.5. The leftauth= and rightauth= settings can be updated similarly if those are in use instead of authby. History ======= 24-03-2026 Libreswan was notified of the issue via security@libreswan.org. 16-06-2026 Advanced notice given to supported customers and distributions. 24-06-2026 Public announcement and release of Libreswan 5.3.1. Credits ======= This vulnerability was found and reported by Yeongheon Choi and Buyeong Kim and further code path vulnerabilities were found by Andrew Galey of the Libreswan Team. Upgrading ========= To address this vulnerability, please upgrade to Libreswan 5.3.1 or later. Patches ======= For those who cannot upgrade, patches for Libreswan 4.15 and 5.3 are available at: https://libreswan.org/security/CVE-2026-50722/ About Libreswan (https://libreswan.org/) ======================================== Libreswan is a free implementation of the Internet Key Exchange (IKE) protocols IKEv1 and IKEv2. It is a descendant (continuation fork) of openswan 2.6.38. IKE is used to establish IPv6c VPN connections. IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN). -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE5h5sdyXK8b0xX01hFLO7MPw+AFa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Goal Reached Thanks to every supporter — we hit 100%!

Libreswan CVE-2026-50722: IKEv2 DoS via malformed PKCS#1.5 signature payload