{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-50722", "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "state": "PUBLISHED", "assignerShortName": "libreswan", "dateReserved": "2026-06-05T16:10:05.751Z", "datePublished": "2026-07-02T21:34:41.413Z", "dateUpdated": "2026-07-07T17:02:06.722Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "shortName": "libreswan", "dateUpdated": "2026-07-02T21:34:41.413Z"}, "title": "IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.</p>"}], "value": "Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected."}], "affected": [{"vendor": "The Libreswan Project", "product": "libreswan", "packageName": "libreswan", "collectionURL": "https://github.com/libreswan/libreswan", "repo": "https://github.com/libreswan/libreswan", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.3", "versionType": "semver"}, {"version": "5.3.1", "status": "unaffected", "versionType": "semver"}], "defaultStatus": "unaffected", "programRoutines": [{"name": "RSA_authenticate_hash_signature_pkcs1_1_5_rsa"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617: Reachable Assertion"}]}], "impacts": [{"capecId": "CAPEC-463", "descriptions": [{"lang": "en", "value": "Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 AUTH payloads"}]}, {"capecId": "CAPEC-473", "descriptions": [{"lang": "en", "value": "Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}, {"other": {"type": "vendorSeverity", "content": {"value": "MEDIUM", "description": "Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart."}}}], "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>If Windows support is not needed, configure <code>authby=ecdsa</code> or <code>authby=rsa-sha2</code> (or both via <code>authby=ecdsa,rsa-sha2</code>) to disallow the fallback of RSA PKCS#1 1.5. The <code>leftauth=</code> and <code>rightauth=</code> settings can be updated similarly if those are in use instead of <code>authby</code>.</p>"}], "value": "If Windows support is not needed, configure authby=ecdsa or authby=rsa-sha2 (or both via authby=ecdsa,rsa-sha2) to disallow the fallback of RSA PKCS#1 1.5. The leftauth= and rightauth= settings can be updated similarly if those are in use instead of authby."}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at <a href=\"https://libreswan.org/security/CVE-2026-50722/\">https://libreswan.org/security/CVE-2026-50722/</a></p>"}], "value": "Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/"}], "exploits": [{"lang": "en", "value": "No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv2 configuration using default authby= settings that permit RSA PKCS#1 v1.5 fallback."}], "configurations": [{"lang": "en", "value": "Any server or client that accepts RSA-based IKEv2 connections via the default authby= settings is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv2 by default allows ECDSA, RSA-SSA-PSS, and RSA PKCS#1 1.5 as fallback due to Microsoft Windows not supporting RSASSA-PSS."}], "credits": [{"lang": "en", "type": "finder", "value": "Yeonghyeon Choi"}, {"lang": "en", "type": "finder", "value": "Duyeong Kim"}, {"lang": "en", "type": "analyst", "value": "Andrew Cagney (The Libreswan Team)"}], "source": {"discovery": "EXTERNAL", "defects": ["CVE-2026-50722"]}, "references": [{"name": "Libreswan Security Advisory CVE-2026-50722", "url": "https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt", "tags": ["vendor-advisory"]}, {"name": "Libreswan CVE-2026-50722 Patches", "url": "https://libreswan.org/security/CVE-2026-50722/", "tags": ["patch"]}, {"name": "Related: CVE-2026-50721 (IKEv1 variant)", "url": "https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt", "tags": ["related"]}, {"name": "RFC 8017 - PKCS #1: RSA Cryptography Specifications Version 2.2", "url": "https://www.rfc-editor.org/rfc/rfc8017", "tags": ["technical-description"]}], "timeline": [{"time": "2026-03-24T00:00:00.000Z", "lang": "en", "value": "Libreswan notified of the issue via security@libreswan.org"}, {"time": "2026-06-16T00:00:00.000Z", "lang": "en", "value": "Advanced notice given to supported customers and distributions"}, {"time": "2026-06-24T00:00:00.000Z", "lang": "en", "value": "Public announcement and release of libreswan 5.3.1"}], "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "15.1", "taxonomyRelations": [{"taxonomyId": "T1499.004", "relationshipName": "maps to", "relationshipValue": "Application or System Exploitation (DoS)"}]}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T18:12:19.317302Z", "id": "CVE-2026-50722", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T17:02:06.722Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-50722", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T18:12:19.317302Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T18:12:20.468Z"}}], "cna": {"title": "IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload", "source": {"defects": ["CVE-2026-50722"], "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Yeonghyeon Choi"}, {"lang": "en", "type": "finder", "value": "Duyeong Kim"}, {"lang": "en", "type": "analyst", "value": "Andrew Cagney (The Libreswan Team)"}], "impacts": [{"capecId": "CAPEC-463", "descriptions": [{"lang": "en", "value": "Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 AUTH payloads"}]}, {"capecId": "CAPEC-473", "descriptions": [{"lang": "en", "value": "Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"}]}, {"other": {"type": "vendorSeverity", "content": {"value": "MEDIUM", "description": "Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart."}}}], "affected": [{"repo": "https://github.com/libreswan/libreswan", "vendor": "The Libreswan Project", "product": "libreswan", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.3"}, {"status": "unaffected", "version": "5.3.1", "versionType": "semver"}], "packageName": "libreswan", "collectionURL": "https://github.com/libreswan/libreswan", "defaultStatus": "unaffected", "programRoutines": [{"name": "RSA_authenticate_hash_signature_pkcs1_1_5_rsa"}]}], "exploits": [{"lang": "en", "value": "No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv2 configuration using default authby= settings that permit RSA PKCS#1 v1.5 fallback."}], "timeline": [{"lang": "en", "time": "2026-03-24T00:00:00.000Z", "value": "Libreswan notified of the issue via security@libreswan.org"}, {"lang": "en", "time": "2026-06-16T00:00:00.000Z", "value": "Advanced notice given to supported customers and distributions"}, {"lang": "en", "time": "2026-06-24T00:00:00.000Z", "value": "Public announcement and release of libreswan 5.3.1"}], "solutions": [{"lang": "en", "value": "Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/", "supportingMedia": [{"type": "text/html", "value": "<p>Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at <a href=\"https://libreswan.org/security/CVE-2026-50722/\">https://libreswan.org/security/CVE-2026-50722/</a></p>", "base64": false}]}], "references": [{"url": "https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt", "name": "Libreswan Security Advisory CVE-2026-50722", "tags": ["vendor-advisory"]}, {"url": "https://libreswan.org/security/CVE-2026-50722/", "name": "Libreswan CVE-2026-50722 Patches", "tags": ["patch"]}, {"url": "https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt", "name": "Related: CVE-2026-50721 (IKEv1 variant)", "tags": ["related"]}, {"url": "https://www.rfc-editor.org/rfc/rfc8017", "name": "RFC 8017 - PKCS #1: RSA Cryptography Specifications Version 2.2", "tags": ["technical-description"]}], "workarounds": [{"lang": "en", "value": "If Windows support is not needed, configure authby=ecdsa or authby=rsa-sha2 (or both via authby=ecdsa,rsa-sha2) to disallow the fallback of RSA PKCS#1 1.5. The leftauth= and rightauth= settings can be updated similarly if those are in use instead of authby.", "supportingMedia": [{"type": "text/html", "value": "<p>If Windows support is not needed, configure <code>authby=ecdsa</code> or <code>authby=rsa-sha2</code> (or both via <code>authby=ecdsa,rsa-sha2</code>) to disallow the fallback of RSA PKCS#1 1.5. The <code>leftauth=</code> and <code>rightauth=</code> settings can be updated similarly if those are in use instead of <code>authby</code>.</p>", "base64": false}]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.", "supportingMedia": [{"type": "text/html", "value": "<p>Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617: Reachable Assertion"}]}], "configurations": [{"lang": "en", "value": "Any server or client that accepts RSA-based IKEv2 connections via the default authby= settings is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv2 by default allows ECDSA, RSA-SSA-PSS, and RSA PKCS#1 1.5 as fallback due to Microsoft Windows not supporting RSASSA-PSS."}], "providerMetadata": {"orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "shortName": "libreswan", "dateUpdated": "2026-07-02T21:34:41.413Z"}, "taxonomyMappings": [{"taxonomyName": "ATT&CK", "taxonomyVersion": "15.1", "taxonomyRelations": [{"taxonomyId": "T1499.004", "relationshipName": "maps to", "relationshipValue": "Application or System Exploitation (DoS)"}]}]}}, "cveMetadata": {"cveId": "CVE-2026-50722", "state": "PUBLISHED", "dateUpdated": "2026-07-07T17:02:06.722Z", "dateReserved": "2026-06-05T16:10:05.751Z", "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df", "datePublished": "2026-07-02T21:34:41.413Z", "assignerShortName": "libreswan"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload", "id": "2494148", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494148"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-347", "details": ["Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.", "A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v1_5 scheme. The RSA_authenticate_hash_signature_pkcs1_1_5_rsa() function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted IKEv2 AUTH payload with a shorter-than-expected hash value. This triggers an internal assertion failure, causing the Libreswan daemon to abort and restart, leading to a Denial of Service (DoS). \nFurthermore, if the Libreswan gateway accepts connections using weak public RSA exponents (such as e=3), an attacker could execute a Bleichenbacher-style signature forgery attack to achieve an authentication bypass."], "mitigation": {"lang": "en:us", "value": "If upgrading to Libreswan is not immediately feasible, this vulnerability can be mitigated by enforcing modern signature algorithms, which effectively prevents Libreswan from falling back to the vulnerable legacy parser logic.\nExplicitly configure your authby (or leftauth/rightauth) parameters in /etc/ipsec.conf to exclusively permit ECDSA and RSASSA-PSS: ```authby=ecdsa,rsa-sha2```\nNote: Applying this mitigation will drop compatibility with native Windows VPN clients that do not support RSASSA-PSS."}, "name": "CVE-2026-50722", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:9::fastdatapath", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Fast Datapath for RHEL 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "libreswan", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-50722\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-50722\nhttps://libreswan.org/security/CVE-2026-50722\nhttps://libreswan.org/security/CVE-2026-50722/\nhttps://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt\nhttps://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/"], "statement": "Red Hat Product Security rates this as having an Moderate security impact. This Moderate severity rating reflects the deployment reality on modern enterprise platforms. The worst-case authentication bypass vector is effectively non-exploitable due to system-wide Crypto-Policies that strictly block the weak RSA exponents required for the attack. Furthermore, the resulting Denial of Service is limited to a controlled process abort via an internal assertion check. Because the Libreswan service is natively managed by systemd with automatic fault-recovery rules enabled by default, the daemon will instantly restart following a crash. Consequently, a sustained outage requires a continuous and high-volume malicious packet flood, significantly lowering the real-world operational risk.", "threat_severity": "Moderate"}