CVE-2026-50721Disclosure(libreswan / libreswan)

LOWCVSS 5.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch libreswan libreswan systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.

libreswan CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

https://www.rfc-editor.org/rfc/rfc2313

Weakness type (CWE)

CWE-347CWE-617

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

libreswan

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-07-02); latest day: 1
3 total mentions across 2 days

Affected systems

Vendors

libreswan

Products

libreswan

Deep dive

Activity timeline3 mentions / 2d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-02	2	Disclosure2
2026-07-03	1	Disclosure1

Full discourse3 posts

Upwind Security MDR@UpwindMDR91d
Disclosure
🚨High - Libreswan RSA Signature Forgery & DoS in IKE Auth (CVE-2026-50722, CVE-2026-50721) Libreswan improperly verifies RSA PKCS#1 signatures during IKE authentication. In `RSA_authenticate_hash_signature_pkcs1_1_5_rsa()` the IKEv2 AUTH payload's DER-encoded ASN.1 digest isn't correctly checked (RFC 8017 / RSASSA-PKCS1-v1_5), and in `RSA_authenticate_hash_signature_raw_rsa()` the IKEv1 SIG payload's hash length isn't verified (RFC 2313). With small public exponents (e.g. e=3), a remote attacker can use a Bleichenbacher-style attack to forge the AUTH/SIG payload and impersonate a peer. Alternatively, encoding a shorter-than-expected hash triggers a reachable assertion: the `pluto` daemon aborts and restarts, and continued exploitation causes sustained denial of service. No RCE is possible, and X.509 certificate verification of the remote IKE peer is not affected. 👉Fixed in Libreswan `5.3.1` (affects `<= 5.3`).
Post summary
The text announces CVE-2026-50722 and CVE-2026-50721 in Libreswan, detailing an RSA signature forgery/DoS flaw, and notes the fix in version 5.3.1.
00000129
236 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-50721 Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1… https://www.cve.org/CVERecord?id=CVE-2026-50721 ----- Traducción: CVE-2026-50721 Lib… http://infoflow.cloud`
Post summary
A brief disclosure of CVE‑2026‑50721 describes a length‑verification flaw in Libreswan’s RSA authentication during IKEv1 processing, with a link to the official CVE record.
0000035
91 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-50721 Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1… https://www.cve.org/CVERecord?id=CVE-2026-50721
Post summary
The entry announces a Libreswan vulnerability involving improper hash length verification in RSA authentication, but offers no evidence of exploitation, patch, or PoC.
00000636
57.7K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	libreswan	libreswan	-	-	-

Explore more

Back to dashboard libreswan CVEs libreswan vulnerabilities