By vendor

Libreswan vulnerabilities

Known CVEs affecting Libreswan products, prioritized by severity, with SEC.co remediation and detection guidance.

3 published vulnerabilities

• CVE-2026-50721HIGH 8.1

  Libreswan, a widely-used open-source IPsec implementation, contains a cryptographic signature verification flaw in its IKEv1 packet handling. When processing authentication signatures (SIG payloads), the library fails to properly validate the length of cryptographic hashes, creating two distinct attack vectors: an attacker with knowledge of small RSA public exponents (such as e=3) can forge authentication credentials and impersonate legitimate peers, while a separate attack path allows remote denial of service by sending malformed signatures that trigger an assertion failure. When exploited for denial of service, the Libreswan daemon crashes and automatically restarts, but repeated exploitation causes sustained outages. The vulnerability does not enable remote code execution, and X.509 certificate-based peer verification remains unaffected.

• CVE-2026-50722HIGH 8.1

  Libreswan, a widely-used open-source IKE/IPsec implementation, contains a flaw in how it validates digital signatures on IKEv2 authentication payloads. The vulnerability stems from improper verification of the ASN.1 encoding structure within RSA signatures. An attacker can exploit this in two ways: first, by forging authentication messages when the target uses a small RSA public exponent (such as e=3), allowing them to impersonate legitimate IKE peers; second, by sending specially crafted malformed signatures that crash the daemon, causing repeated denial of service. While serious, this does not enable remote code execution, and X.509 certificate chains remain properly validated.

• CVE-2026-12413HIGH 7.5

  Libreswan, a widely-deployed open-source VPN implementation, contains a flaw in how it processes fragmented IKEv2 (Internet Key Exchange version 2) messages. When a specially malformed fragment arrives, the pluto daemon—the core IKEv2 negotiation process—crashes and restarts. An attacker can repeatedly send these crafted fragments to force repeated crashes, creating a denial-of-service condition. The flaw stems from an off-by-one error that allows the daemon to write beyond its intended buffer bounds, triggering a fatal assertion. Remote code execution is not possible. Only systems configured to accept IKEv2 connections without explicitly disabling fragmentation are at risk.