CVE-2026-50722: Libreswan IKEv2 Authentication Forgery and Denial-of-Service Vulnerability

Technical summary

CVE-2026-50722 affects the RSA_authenticate_hash_signature_pkcs1_1_5_rsa() function in Libreswan's IKEv2 authentication handling. The vulnerability manifests as inadequate DER encoding verification of ASN.1 digest structures within RSASSA-PKCS1-v1_1_5 signatures (RFC 8017). This enables two distinct attack vectors: (1) a Bleichenbacher-style forgery attack when small public exponents are deployed, permitting AUTH payload spoofing and peer impersonation; (2) a denial-of-service vector via malformed hash encoding that triggers assertion failures, forcing daemon restart. The root causes map to CWE-347 (Improper Verification of Cryptographic Signature) and CWE-617 (Reachable Assertion).

Business impact

Organizations deploying Libreswan as a VPN termination point or IPsec gateway face two material risks. Authentication bypass enables an attacker to establish seemingly legitimate tunnel endpoints, potentially redirecting sensitive traffic or injecting data into encrypted sessions. Repeated DoS attacks can disrupt VPN availability, isolating remote workers or branch offices. The threat is particularly acute in environments where Libreswan peers are exposed to untrusted networks without additional out-of-band peer authentication. However, the limitation to authentication payload forgery—not encryption bypass or certificate validation failure—constrains the exposure compared to lower-level IPsec implementation flaws.

Affected systems

Libreswan versions prior to the patched release are vulnerable. The flaw is most severe when Libreswan instances are configured to accept peers using small RSA exponents (e=3), a practice still seen in legacy deployments. Any Libreswan instance performing IKEv2 authentication with RSA signatures is susceptible to the DoS vector. Verify your installed version against the official Libreswan security advisory to determine applicability.

Exploitability

The authentication forgery requires sophisticated cryptographic attack execution and is most practical against deployments using small RSA exponents. Real-world Bleichenbacher attacks are non-trivial but have been demonstrated in the literature. The DoS vector is trivial to exploit—an attacker need only craft a single malformed IKEv2 packet—making sustained denial of service a realistic threat if the attacker has network-level access to the IKE peer. No public exploit code is known, and active exploitation in the wild has not been reported as of publication.

Remediation

Apply the patched Libreswan version released by the project. Verify against the official Libreswan security advisory for the specific version number addressing this CVE. As an interim mitigation, disable or restrict IKEv2 authentication using RSA signatures where feasible, substituting ECDSA or other asymmetric algorithms if peer configurations permit. Restrict IKE listener access via firewall rules to known, trusted peer IP ranges. Monitor Libreswan daemon logs for repeated crashes or authentication failures.

Patch guidance

Consult the official Libreswan project security advisory and release notes to identify the patched version that addresses CVE-2026-50722. Apply updates through your standard change management process, testing in a pre-production environment first. Given the DoS vector's ease of exploitation, prioritize patching on production IKE gateways. A daemon restart is required for the new code to take effect.

Detection guidance

Monitor Libreswan logs for repeated daemon crashes, assertion failures, or authentication errors coinciding with IKEv2 AUTH payload processing. Elevated rates of IKEv2 packet rejections or malformed signature rejections may signal attack attempts. Network-level detection is challenging without deep IKEv2 inspection; however, anomalous spikes in failed IKE_SA_INIT or IKE_AUTH exchanges from unusual sources warrant investigation. Correlate with firewall and endpoint logs to identify potential attacker infrastructure.

Why prioritize this

This vulnerability merits urgent attention due to its CVSS 8.1 HIGH severity, the feasibility of sustained DoS attacks, and the authentication impersonation risk in certain configurations. While not yet in CISA KEV and without public exploits, the combination of authentication bypass and denial-of-service capabilities, coupled with Libreswan's prevalence in enterprise and service-provider VPN deployments, creates substantial business risk. Organizations relying on Libreswan for critical network segmentation should prioritize patching.

Risk score, explained

The CVSS 8.1 score reflects high-impact confidentiality and integrity compromise (authentication forgery), high availability impact (DoS), and network-adjacent attack vector. The 'High' constraint on attack complexity reflects the cryptographic sophistication required for the forgery vector, which tempers the score relative to a trivial DoS-only flaw. The network-accessible nature and lack of authentication/UI barriers elevate the score despite the AC:H requirement.

Frequently asked questions