{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50721", "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "state": "PUBLISHED", "assignerShortName": "libreswan", "dateReserved": "2026-06-05T16:10:05.751Z", "datePublished": "2026-07-02T21:44:09.423Z", "dateUpdated": "2026-07-07T17:01:58.011Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "shortName": "libreswan", "dateUpdated": "2026-07-02T21:44:09.423Z"}, "title": "IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.</p>"}], "value": "Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected."}], "affected": [{"vendor": "The Libreswan Project", "product": "libreswan", "packageName": "libreswan", "collectionURL": "https://github.com/libreswan/libreswan", "repo": "https://github.com/libreswan/libreswan", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.3", "versionType": "semver"}, {"version": "5.3.1", "status": "unaffected", "versionType": "semver"}], "defaultStatus": "unaffected", "programRoutines": [{"name": "RSA_authenticate_hash_signature_raw_rsa"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617: Reachable Assertion"}]}], "impacts": [{"capecId": "CAPEC-463", "descriptions": [{"lang": "en", "value": "Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 SIG payloads in IKEv1"}]}, {"capecId": "CAPEC-473", "descriptions": [{"lang": "en", "value": "Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}, {"other": {"type": "vendorSeverity", "content": {"value": "MEDIUM", "description": "Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart."}}}], "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where <code>authby=ecdsa</code> or <code>authby=rsa-sha2</code> can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via <code>authby=secret</code> after coordination with the remote peer.</p>"}], "value": "IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where authby=ecdsa or authby=rsa-sha2 can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via authby=secret after coordination with the remote peer."}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at <a href=\"https://libreswan.org/security/CVE-2026-50721/\">https://libreswan.org/security/CVE-2026-50721/</a></p>"}], "value": "Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50721/"}], "exploits": [{"lang": "en", "value": "No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv1 configuration using the default authby=rsasig option."}], "configurations": [{"lang": "en", "value": "Any server or client that accepts RSA-based IKEv1 connections via the default authby=rsasig option is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) for public key authentication, so the vulnerable code path cannot be disabled without migrating to IKEv2 or switching to PSK."}], "credits": [{"lang": "en", "type": "finder", "value": "Yeonghyeon Choi"}, {"lang": "en", "type": "finder", "value": "Duyeong Kim"}, {"lang": "en", "type": "analyst", "value": "Andrew Cagney (The Libreswan Team)"}], "source": {"discovery": "EXTERNAL", "defects": ["CVE-2026-50721"]}, "references": [{"name": "Libreswan Security Advisory CVE-2026-50721", "url": "https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt", "tags": ["vendor-advisory"]}, {"name": "Libreswan CVE-2026-50721 Patches", "url": "https://libreswan.org/security/CVE-2026-50721/", "tags": ["patch"]}, {"name": "Related: CVE-2026-50722 (IKEv2 variant)", "url": "https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt", "tags": ["related"]}, {"name": "RFC 2313 - PKCS #1: RSA Encryption Version 1.5", "url": "https://www.rfc-editor.org/rfc/rfc2313", "tags": ["technical-description"]}], "timeline": [{"time": "2026-03-24T00:00:00.000Z", "lang": "en", "value": "Libreswan notified of the issue via security@libreswan.org"}, {"time": "2026-06-16T00:00:00.000Z", "lang": "en", "value": "Advanced notice given to supported customers and distributions"}, {"time": "2026-06-24T00:00:00.000Z", "lang": "en", "value": "Public announcement and release of libreswan 5.3.1"}], "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "15.1", "taxonomyRelations": [{"taxonomyId": "T1499.004", "relationshipName": "maps to", "relationshipValue": "Application or System Exploitation (DoS)"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T18:12:17.199605Z", "id": "CVE-2026-50721", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T17:01:58.011Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50721", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T18:12:17.199605Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T18:12:18.227Z"}}], "cna": {"title": "IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload", "source": {"defects": ["CVE-2026-50721"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Yeonghyeon Choi"}, {"lang": "en", "type": "finder", "value": "Duyeong Kim"}, {"lang": "en", "type": "analyst", "value": "Andrew Cagney (The Libreswan Team)"}], "impacts": [{"capecId": "CAPEC-463", "descriptions": [{"lang": "en", "value": "Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 SIG payloads in IKEv1"}]}, {"capecId": "CAPEC-473", "descriptions": [{"lang": "en", "value": "Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"}]}, {"other": {"type": "vendorSeverity", "content": {"value": "MEDIUM", "description": "Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart."}}}], "affected": [{"repo": "https://github.com/libreswan/libreswan", "vendor": "The Libreswan Project", "product": "libreswan", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.3"}, {"status": "unaffected", "version": "5.3.1", "versionType": "semver"}], "packageName": "libreswan", "collectionURL": "https://github.com/libreswan/libreswan", "defaultStatus": "unaffected", "programRoutines": [{"name": "RSA_authenticate_hash_signature_raw_rsa"}]}], "exploits": [{"lang": "en", "value": "No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv1 configuration using the default authby=rsasig option."}], "timeline": [{"lang": "en", "time": "2026-03-24T00:00:00.000Z", "value": "Libreswan notified of the issue via security@libreswan.org"}, {"lang": "en", "time": "2026-06-16T00:00:00.000Z", "value": "Advanced notice given to supported customers and distributions"}, {"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Public announcement and release of libreswan 5.3.1"}], "solutions": [{"lang": "en", "value": "Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50721/", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at <a href=\"https://libreswan.org/security/CVE-2026-50721/\">https://libreswan.org/security/CVE-2026-50721/</a></p>", "base64": false}]}], "references": [{"url": "https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt", "name": "Libreswan Security Advisory CVE-2026-50721", "tags": ["vendor-advisory"]}, {"url": "https://libreswan.org/security/CVE-2026-50721/", "name": "Libreswan CVE-2026-50721 Patches", "tags": ["patch"]}, {"url": "https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt", "name": "Related: CVE-2026-50722 (IKEv2 variant)", "tags": ["related"]}, {"url": "https://www.rfc-editor.org/rfc/rfc2313", "name": "RFC 2313 - PKCS #1: RSA Encryption Version 1.5", "tags": ["technical-description"]}], "workarounds": [{"lang": "en", "value": "IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where authby=ecdsa or authby=rsa-sha2 can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via authby=secret after coordination with the remote peer.", "supportingMedia": [{"type": "text/html", "value": "<p>IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where <code>authby=ecdsa</code> or <code>authby=rsa-sha2</code> can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via <code>authby=secret</code> after coordination with the remote peer.</p>", "base64": false}]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.", "supportingMedia": [{"type": "text/html", "value": "<p>Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617: Reachable Assertion"}]}], "configurations": [{"lang": "en", "value": "Any server or client that accepts RSA-based IKEv1 connections via the default authby=rsasig option is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) for public key authentication, so the vulnerable code path cannot be disabled without migrating to IKEv2 or switching to PSK."}], "providerMetadata": {"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "shortName": "libreswan", "dateUpdated": "2026-07-02T21:44:09.423Z"}, "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "15.1", "taxonomyRelations": [{"taxonomyId": "T1499.004", "relationshipName": "maps to", "relationshipValue": "Application or System Exploitation (DoS)"}]}]}}, "cveMetadata": {"cveId": "CVE-2026-50721", "state": "PUBLISHED", "dateUpdated": "2026-07-07T17:01:58.011Z", "dateReserved": "2026-06-05T16:10:05.751Z", "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "datePublished": "2026-07-02T21:44:09.423Z", "assignerShortName": "libreswan"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload", "id": "2494147", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494147"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-347", "details": ["Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.", "A flaw was found in Libreswan's implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS #1 v1.5 RSA encryption, the RSA_authenticate_hash_signature_raw_rsa() function fails to properly validate the length of the authentication hash. A remote, unauthenticated attacker could exploit this vulnerability by sending a specially crafted IKEv1 packet containing a shorter-than-expected hash payload. This triggers an assertion failure within the Libreswan daemon, causing it to crash and restart, leading to a persistent Denial of Service (DoS) condition if malicious packets are continuously transmitted.\nAdditionally, if the target system relies on RSA keys with weak public exponents (e.g., e=3), a Bleichenbacher-style signature forgery attack may be feasible, potentially allowing the attacker to bypass authentication entirely."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, consider the following strategic workarounds if upgrading Libreswan immediately is not viable:\n- Migrate to IKEv2: Disable IKEv1 entirely and migrate all connections to IKEv2. The vulnerable code path is tied specifically to IKEv1\u2019s rigid handling of PKCS#1 v1.5 RSA-SHA1.\n- Switch to Pre-Shared Keys (PSK): Additionally, if the configuration is for static tunnels, and not for a group of Remote Access VPN Clients, the authentication can be changed to use PSK via \"authby=secret\" after coordination with the remote peer."}, "name": "CVE-2026-50721", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:9::fastdatapath", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Fast Datapath for RHEL 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50721\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50721\nhttps://libreswan.org/security/CVE-2026-50721/\nhttps://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt\nhttps://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/"], "statement": "Red Hat Product Security rates this as having an Moderate security impact, because this vulnerability directly affects the availability of Libreswan VPN gateways utilizing legacy IKEv1 tunnels. IKEv1 is not default in modern RHEL; modern profiles enforce IKEv2. Because the crash occurs during the unauthenticated phase of the IKE negotiation, any exposed Libreswan service (server or client) accepting standard IKEv1 connections via the default (authby=rsasig) option is vulnerable to the Denial of Service aspect of this flaw. \nAdditionally, the risk of the authentication bypass vector is mitigated to low on Red Hat Enterprise Linux due to system-wide Crypto-Policies that strictly disallow the generation and use of keys with weak public exponents. This completely neutralizes the worst-case Authentication Bypass and Impersonation vectors for CVE-2026-50721, confining the threat strictly to a DoS process crash.", "threat_severity": "Moderate"}