Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.
"}],"value":"Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected."}],"affected":[{"vendor":"The Libreswan Project","product":"libreswan","packageName":"libreswan","collectionURL":"https://github.com/libreswan/libreswan","repo":"https://github.com/libreswan/libreswan","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.3","versionType":"semver"},{"version":"5.3.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","programRoutines":[{"name":"RSA_authenticate_hash_signature_raw_rsa"}]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-347","description":"CWE-347: Improper Verification of Cryptographic Signature"}]},{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-617","description":"CWE-617: Reachable Assertion"}]}],"impacts":[{"capecId":"CAPEC-463","descriptions":[{"lang":"en","value":"Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 SIG payloads in IKEv1"}]},{"capecId":"CAPEC-473","descriptions":[{"lang":"en","value":"Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"}]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"other":{"type":"vendorSeverity","content":{"value":"MEDIUM","description":"Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart."}}}],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where authby=ecdsa or authby=rsa-sha2 can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via authby=secret after coordination with the remote peer.
Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50721/
"}],"value":"Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50721/"}],"exploits":[{"lang":"en","value":"No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv1 configuration using the default authby=rsasig option."}],"configurations":[{"lang":"en","value":"Any server or client that accepts RSA-based IKEv1 connections via the default authby=rsasig option is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) for public key authentication, so the vulnerable code path cannot be disabled without migrating to IKEv2 or switching to PSK."}],"credits":[{"lang":"en","type":"finder","value":"Yeonghyeon Choi"},{"lang":"en","type":"finder","value":"Duyeong Kim"},{"lang":"en","type":"analyst","value":"Andrew Cagney (The Libreswan Team)"}],"source":{"discovery":"EXTERNAL","defects":["CVE-2026-50721"]},"references":[{"name":"Libreswan Security Advisory CVE-2026-50721","url":"https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt","tags":["vendor-advisory"]},{"name":"Libreswan CVE-2026-50721 Patches","url":"https://libreswan.org/security/CVE-2026-50721/","tags":["patch"]},{"name":"Related: CVE-2026-50722 (IKEv2 variant)","url":"https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt","tags":["related"]},{"name":"RFC 2313 - PKCS #1: RSA Encryption Version 1.5","url":"https://www.rfc-editor.org/rfc/rfc2313","tags":["technical-description"]}],"timeline":[{"time":"2026-03-24T00:00:00.000Z","lang":"en","value":"Libreswan notified of the issue via security@libreswan.org"},{"time":"2026-06-16T00:00:00.000Z","lang":"en","value":"Advanced notice given to supported customers and distributions"},{"time":"2026-06-24T00:00:00.000Z","lang":"en","value":"Public announcement and release of libreswan 5.3.1"}],"taxonomyMappings":[{"taxonomyName":"ATT&CK","taxonomyVersion":"15.1","taxonomyRelations":[{"taxonomyId":"T1499.004","relationshipName":"maps to","relationshipValue":"Application or System Exploitation (DoS)"}]}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-06T18:12:17.199605Z","id":"CVE-2026-50721","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-07T17:01:58.011Z"}}]}}