Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.
"}],"value":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected."}],"affected":[{"vendor":"The Libreswan Project","product":"libreswan","packageName":"libreswan","collectionURL":"https://github.com/libreswan/libreswan","repo":"https://github.com/libreswan/libreswan","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.3","versionType":"semver"},{"version":"5.3.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","programRoutines":[{"name":"RSA_authenticate_hash_signature_pkcs1_1_5_rsa"}]}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-347","description":"CWE-347: Improper Verification of Cryptographic Signature"}]},{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-617","description":"CWE-617: Reachable Assertion"}]}],"impacts":[{"capecId":"CAPEC-463","descriptions":[{"lang":"en","value":"Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 AUTH payloads"}]},{"capecId":"CAPEC-473","descriptions":[{"lang":"en","value":"Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"}]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"other":{"type":"vendorSeverity","content":{"value":"MEDIUM","description":"Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart."}}}],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"If Windows support is not needed, configure authby=ecdsa or authby=rsa-sha2 (or both via authby=ecdsa,rsa-sha2) to disallow the fallback of RSA PKCS#1 1.5. The leftauth= and rightauth= settings can be updated similarly if those are in use instead of authby.
Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/
"}],"value":"Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/"}],"exploits":[{"lang":"en","value":"No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv2 configuration using default authby= settings that permit RSA PKCS#1 v1.5 fallback."}],"configurations":[{"lang":"en","value":"Any server or client that accepts RSA-based IKEv2 connections via the default authby= settings is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv2 by default allows ECDSA, RSA-SSA-PSS, and RSA PKCS#1 1.5 as fallback due to Microsoft Windows not supporting RSASSA-PSS."}],"credits":[{"lang":"en","type":"finder","value":"Yeonghyeon Choi"},{"lang":"en","type":"finder","value":"Duyeong Kim"},{"lang":"en","type":"analyst","value":"Andrew Cagney (The Libreswan Team)"}],"source":{"discovery":"EXTERNAL","defects":["CVE-2026-50722"]},"references":[{"name":"Libreswan Security Advisory CVE-2026-50722","url":"https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt","tags":["vendor-advisory"]},{"name":"Libreswan CVE-2026-50722 Patches","url":"https://libreswan.org/security/CVE-2026-50722/","tags":["patch"]},{"name":"Related: CVE-2026-50721 (IKEv1 variant)","url":"https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt","tags":["related"]},{"name":"RFC 8017 - PKCS #1: RSA Cryptography Specifications Version 2.2","url":"https://www.rfc-editor.org/rfc/rfc8017","tags":["technical-description"]}],"timeline":[{"time":"2026-03-24T00:00:00.000Z","lang":"en","value":"Libreswan notified of the issue via security@libreswan.org"},{"time":"2026-06-16T00:00:00.000Z","lang":"en","value":"Advanced notice given to supported customers and distributions"},{"time":"2026-06-24T00:00:00.000Z","lang":"en","value":"Public announcement and release of libreswan 5.3.1"}],"taxonomyMappings":[{"taxonomyName":"ATT&CK","taxonomyVersion":"15.1","taxonomyRelations":[{"taxonomyId":"T1499.004","relationshipName":"maps to","relationshipValue":"Application or System Exploitation (DoS)"}]}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-06T18:12:19.317302Z","id":"CVE-2026-50722","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-07-07T17:02:06.722Z"}}]}}