{"id":"CVE-2026-50722","aliases":["ALPINE-CVE-2026-50722","ALSA-2026:46396","ALSA-2026:46397","ALSA-2026:46398","AZL-91776","CLSA-2026-1784131746","CLSA-2026-1784305067","DEBIAN-CVE-2026-50722","EUVD-2026-41440","GHSA-h4cv-5vw8-2p6m","OESA-2026-2909","OESA-2026-2910","OESA-2026-2911","OESA-2026-2912","OESA-2026-3073","RHSA-2026:46396","RHSA-2026:46397","RHSA-2026:46398","RHSA-2026:46986","RHSA-2026:55449","RHSA-2026:57741","RHSA-2026:61258","RHSA-2026:61779","RHSA-2026:72287","RHSA-2026:82154","RHSA-2026:84887","RLSA-2026:46396","RLSA-2026:46397","RLSA-2026:46398","UBUNTU-CVE-2026-50722"],"status":"published","title":"IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00346,"percentile":0.28474,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347","CWE-617"],"published":"2026-07-02T21:34:41Z","modified":"2026-11-05T17:30:49Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"libreswan","fixed_in":["5.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libreswan","fixed_in":["5.3.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libreswan","fixed_in":["4.15-2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libreswan","fixed_in":["4.12-2.el9_2.tuxcare.els3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12-2.el8_10.6"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-10.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libreswan-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.2-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12-2.el9_2.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-8.el9_6.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.10-2","4.10-2+deb12u1","4.11-1","4.12-1","4.12-2","4.12-3","4.14-1","4.14-1.1","4.15-1","5.0~rc2-1","5.0~rc2-2","5.2-1","5.2-2","5.2-2.1","5.2-2.2","5.2-2.3","5.2-2.4","5.2-2.5"]},{"source":"osv","ecosystem":"Debian:13","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-2.2","5.2-2.3","5.2-2.4","5.2-2.5"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-3.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-3.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-3.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-3.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-3.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el8_10.6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el8_10.6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el8_10.6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.15-10.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.15-10.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.15-10.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.2-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.2-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libreswan-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.2-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libreswan-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.2-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.2-1.el9fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"libreswan-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.2-1.el9fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"libreswan-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.2-1.el9fdp"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-1.el10_0.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.15-8.el9_6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-3.el9_4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9-5.el9_2.5"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9-3.el8_8.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9-3.el8_8.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5-1.el8_6.6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3-6.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3-6.el8_4.2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12-2.el8_10.6"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.15-10.el9_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.2-1.el10_2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20-7build1","3.21-2","3.22-1","3.22-2","3.22-3","3.22-4","3.23-1","3.23-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.29-2","3.29-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.32-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11-1ubuntu1","4.12-1ubuntu1","4.14-1ubuntu1","4.14-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.14-1ubuntu2","5.2-2.2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-2.2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libreswan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-2.2ubuntu1","5.2-2.2ubuntu2"]}],"products":[{"vendor":"libreswan","product":"libreswan"},{"vendor":"the libreswan project","product":"libreswan"},{"vendor":"the libreswan project (www.libreswan.org)","product":"libreswan"}],"references":[{"url":"https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"https://libreswan.org/security/CVE-2026-50722/","tags":["patch","Vendor Advisory","advisory","article","report"]},{"url":"https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt","tags":["related","Vendor Advisory","Mailing List","advisory","article","report"]},{"url":"https://www.rfc-editor.org/rfc/rfc8017","tags":["technical-description","Technical Description","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50722","tags":["web","advisory"]},{"url":"https://libreswan.org/security/CVE-2026-50722","tags":["article"]},{"url":"https://github.com/advisories/GHSA-h4cv-5vw8-2p6m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-50722","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46396","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12413","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14957","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50721","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50722","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494147","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494148","tags":["report"]},{"url":"https://bugzilla.redhat.com/2494149","tags":["report"]},{"url":"https://bugzilla.redhat.com/2501764","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-46396.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46397","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-46397.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46398","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-46398.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784131746.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784305067.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50721","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-50722","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12413","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2910","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2911","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2912","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3073","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494147","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2501764","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46396.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12413","tags":["advisory"]},{"url":"https://libreswan.org/security/CVE-2026-12413/","tags":["article"]},{"url":"https://libreswan.org/security/CVE-2026-12413/CVE-2026-12413.txt","tags":["article"]},{"url":"https://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14957","tags":["advisory"]},{"url":"https://libreswan.org/security/CVE-2026-14957/","tags":["article"]},{"url":"https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50721","tags":["advisory"]},{"url":"https://libreswan.org/security/CVE-2026-50721/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-50722","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46397.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46398.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46986","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46986.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55449","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55449.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57741","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57741.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61258","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61258.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61779","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61779.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:72287","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72287.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82154","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82154.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84887","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84887.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:46396","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:46397","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:46398","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-50722","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-50722","title":"IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","status":"published","published":"2026-07-02T21:34:41.413Z","modified":"2026-07-07T17:02:06.722Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-347","CWE-617"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-41440","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","status":"published","published":"2026-07-02T21:34:41Z","modified":"2026-07-07T17:02:06Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:11.442824Z"}],"ghsa":[{"id":"GHSA-h4cv-5vw8-2p6m","title":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly...","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","status":"published","published":"2026-07-03T00:31:53Z","modified":"2026-07-03T00:31:53Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:09:13.018027Z"}],"nvd":[{"id":"CVE-2026-50722","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","status":"published","published":"2026-07-02T22:16:43.55Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-347","CWE-617"],"updated_at":"2026-11-02T14:12:27.541515Z"}],"osv":[{"id":"ALPINE-CVE-2026-50722","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","status":"published","published":"2026-07-02T22:16:43.55Z","modified":"2026-11-03T06:33:05.804249437Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"CVE-2026-50722","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","status":"published","published":"2026-07-02T22:16:43.55Z","modified":"2026-10-27T02:30:54.588138854Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"DEBIAN-CVE-2026-50722","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","status":"published","published":"2026-07-02T22:16:43.55Z","modified":"2026-11-05T17:30:49.230409454Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T17:54:24.591011Z"},{"id":"OESA-2026-2909","title":"libreswan security update","description":"Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services.  These services allow you to build secure tunnels through untrusted networks.  Everything passing through the untrusted net is encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel.  The resulting tunnel is a virtual private network or VPN.\r\n\r\nSecurity Fix(es):\n\nAn invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u0026gt;digest_roof \u0026lt; elemsof(md-\u0026gt;digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.(CVE-2026-12413)\n\nLibreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.(CVE-2026-50721)\n\nLibreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.(CVE-2026-50722)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.555704828Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2910","title":"libreswan security update","description":"Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services.  These services allow you to build secure tunnels through untrusted networks.  Everything passing through the untrusted net is encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel.  The resulting tunnel is a virtual private network or VPN.\r\n\r\nSecurity Fix(es):\n\nAn invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u0026gt;digest_roof \u0026lt; elemsof(md-\u0026gt;digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.(CVE-2026-12413)\n\nLibreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.(CVE-2026-50721)\n\nLibreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.(CVE-2026-50722)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.152763959Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2911","title":"libreswan security update","description":"Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services.  These services allow you to build secure tunnels through untrusted networks.  Everything passing through the untrusted net is encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel.  The resulting tunnel is a virtual private network or VPN.\r\n\r\nSecurity Fix(es):\n\nAn invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u0026gt;digest_roof \u0026lt; elemsof(md-\u0026gt;digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.(CVE-2026-12413)\n\nLibreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.(CVE-2026-50721)\n\nLibreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.(CVE-2026-50722)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.654980739Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2912","title":"libreswan security update","description":"Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services.  These services allow you to build secure tunnels through untrusted networks.  Everything passing through the untrusted net is encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel.  The resulting tunnel is a virtual private network or VPN.\r\n\r\nSecurity Fix(es):\n\nAn invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u0026gt;digest_roof \u0026lt; elemsof(md-\u0026gt;digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.(CVE-2026-12413)\n\nLibreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.(CVE-2026-50721)\n\nLibreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.(CVE-2026-50722)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.207559624Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3073","title":"libreswan security update","description":"Libreswan is an implementation of IKEv1 and IKEv2 for IPsec. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services.  These services allow you to build secure tunnels through untrusted networks.  Everything passing through the untrusted net is encrypted by the ipsec gateway machine and decrypted by the gateway at the other end of the tunnel.  The resulting tunnel is a virtual private network or VPN.\r\n\r\nSecurity Fix(es):\n\nAn invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md-\u0026gt;digest_roof \u0026lt; elemsof(md-\u0026gt;digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected.(CVE-2026-12413)\n\nLibreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.(CVE-2026-50721)\n\nLibreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.(CVE-2026-50722)","status":"published","published":"2026-07-19T11:11:57Z","modified":"2026-08-18T01:21:20.237487734Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:46396","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-07-28T10:13:47Z","modified":"2026-10-20T10:09:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:46397","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-07-28T10:13:47Z","modified":"2026-10-20T10:09:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:46398","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-07-28T10:13:48Z","modified":"2026-10-20T10:09:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:46986","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-07-28T10:13:57Z","modified":"2026-10-20T10:09:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:55449","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-08-17T10:17:01Z","modified":"2026-10-20T10:11:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:57741","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-08-21T10:14:08Z","modified":"2026-10-20T10:11:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:61258","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-08-31T10:12:13Z","modified":"2026-10-20T10:12:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:61779","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-09-01T10:28:39Z","modified":"2026-10-20T10:12:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:72287","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-09-28T10:15:56Z","modified":"2026-10-20T10:15:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:82154","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-10-14T10:32:42Z","modified":"2026-10-20T10:16:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84887","title":"Red Hat Security Advisory: libreswan security update","status":"published","published":"2026-10-20T10:17:56Z","modified":"2026-10-20T10:31:43.071694973Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:46396","title":"Important: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)\n\n* librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)\n\n* librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)\n\n* libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-28T06:01:06.284655Z","modified":"2026-07-28T06:30:06.247433821Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:46397","title":"Important: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)\n\n* librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)\n\n* librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)\n\n* libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-27T12:04:22.718076Z","modified":"2026-07-27T12:30:05.568570321Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:46398","title":"Important: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)\n\n* librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)\n\n* librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)\n\n* libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-28T18:05:53.08241Z","modified":"2026-07-28T18:26:06.748754563Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-50722","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","status":"published","published":"2026-07-02T22:16:00Z","modified":"2026-10-17T12:59:00.871055591Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"ALSA-2026:46396","title":"Important: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).  \n\nSecurity Fix(es):  \n\n  * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)\n  * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)\n  * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)\n  * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-10-29T11:02:28.648120203Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:46397","title":"Important: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).  \n\nSecurity Fix(es):  \n\n  * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)\n  * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)\n  * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)\n  * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-10-29T11:32:22.922771688Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:46398","title":"Important: libreswan security update","description":"Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).  \n\nSecurity Fix(es):  \n\n  * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)\n  * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)\n  * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)\n  * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-10-29T11:30:36.297987212Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-91776","title":"CVE-2026-50722 affecting package libreswan for versions less than 4.15-2","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","status":"published","published":"2026-07-02T22:16:43Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1784131746","title":"libreswan: Fix of CVE-2026-50722","description":"- CVE-2026-50722: fix improper DER validation of the ASN.1 digest in IKEv2\n  RSASSA-PKCS1-v1_5 AUTH verification","status":"published","published":"2026-07-15T16:09:19Z","modified":"2026-10-26T09:30:12.690208045Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784305067","title":"libreswan: Fix of 2 CVEs","description":"- CVE-2026-50721: fix incomplete RSA signature verification accepting a truncated AUTH HASH\n- CVE-2026-50722: fix assertion failure on a truncated HASH payload","status":"published","published":"2026-07-17T16:18:11Z","modified":"2026-10-26T09:31:18.313837631Z","updated_at":"2026-11-02T15:43:46.151924Z"}]}}