{"id":"CVE-2026-50721","state":"PUBLISHED","title":"IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload","description":"Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.","publishedAt":"2026-07-02T21:44:09.423Z","updatedAt":"2026-07-07T17:01:58.011Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"libreswan"},"assigner":"libreswan","products":["The Libreswan Project libreswan"],"affected":[{"vendor":"The Libreswan Project","product":"libreswan","packageName":"libreswan","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.3","versionType":"semver"},{"version":"5.3.1","status":"unaffected","versionType":"semver"}],"collectionURL":"https://github.com/libreswan/libreswan","repo":"https://github.com/libreswan/libreswan","programRoutines":[{"name":"RSA_authenticate_hash_signature_raw_rsa"}]}],"references":["https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt","https://libreswan.org/security/CVE-2026-50721/","https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt","https://www.rfc-editor.org/rfc/rfc2313"],"weaknesses":["CWE-347","CWE-617"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/50xxx/CVE-2026-50721.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-50721","state":"PUBLISHED","datePublished":"2026-07-02T21:44:09.423Z","dateUpdated":"2026-07-07T17:01:58.011Z","assignerShortName":"libreswan","assignerOrgId":"d42dc95b-23f1-4e06-9076-20753a0fb0df","dateReserved":"2026-06-05T16:10:05.751Z"},"containers":{"cna":{"title":"IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload","descriptions":[{"lang":"en","value":"Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected."}],"affected":[{"vendor":"The Libreswan Project","product":"libreswan","packageName":"libreswan","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.3","versionType":"semver"},{"version":"5.3.1","status":"unaffected","versionType":"semver"}],"collectionURL":"https://github.com/libreswan/libreswan","repo":"https://github.com/libreswan/libreswan","programRoutines":[{"name":"RSA_authenticate_hash_signature_raw_rsa"}]}],"references":[{"url":"https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt","name":"Libreswan Security Advisory CVE-2026-50721","tags":["vendor-advisory"]},{"url":"https://libreswan.org/security/CVE-2026-50721/","name":"Libreswan CVE-2026-50721 Patches","tags":["patch"]},{"url":"https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt","name":"Related: CVE-2026-50722 (IKEv2 variant)","tags":["related"]},{"url":"https://www.rfc-editor.org/rfc/rfc2313","name":"RFC 2313 - PKCS #1: RSA Encryption Version 1.5","tags":["technical-description"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"other":{"type":"vendorSeverity","content":{"value":"MEDIUM","description":"Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart."}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-347","lang":"en","type":"CWE","description":"CWE-347: Improper Verification of Cryptographic Signature"}]},{"descriptions":[{"cweId":"CWE-617","lang":"en","type":"CWE","description":"CWE-617: Reachable Assertion"}]}],"providerMetadata":{"shortName":"libreswan","orgId":"d42dc95b-23f1-4e06-9076-20753a0fb0df","dateUpdated":"2026-07-02T21:44:09.423Z"},"impacts":[{"capecId":"CAPEC-463","descriptions":[{"lang":"en","value":"Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 SIG payloads in IKEv1"}]},{"capecId":"CAPEC-473","descriptions":[{"lang":"en","value":"Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"}]}],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where <code>authby=ecdsa</code> or <code>authby=rsa-sha2</code> can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via <code>authby=secret</code> after coordination with the remote peer.</p>"}],"value":"IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) with public key authentication, so there is no way to disable the vulnerable code path within IKEv1. Migrate IKEv1 connections to IKEv2 where authby=ecdsa or authby=rsa-sha2 can be configured. For static tunnel configurations (not Remote Access VPN Client groups), authentication can be changed to use PSK via authby=secret after coordination with the remote peer."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at <a href=\"https://libreswan.org/security/CVE-2026-50721/\">https://libreswan.org/security/CVE-2026-50721/</a></p>"}],"value":"Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50721/"}],"exploits":[{"lang":"en","value":"No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv1 configuration using the default authby=rsasig option."}],"configurations":[{"lang":"en","value":"Any server or client that accepts RSA-based IKEv1 connections via the default authby=rsasig option is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv1 only supports RSA-SHA1 (PKCS#1 Version 1.5) for public key authentication, so the vulnerable code path cannot be disabled without migrating to IKEv2 or switching to PSK."}],"credits":[{"lang":"en","type":"finder","value":"Yeonghyeon Choi"},{"lang":"en","type":"finder","value":"Duyeong Kim"},{"lang":"en","type":"analyst","value":"Andrew Cagney (The Libreswan Team)"}],"source":{"discovery":"EXTERNAL","defects":["CVE-2026-50721"]},"timeline":[{"time":"2026-03-24T00:00:00.000Z","lang":"en","value":"Libreswan notified of the issue via security@libreswan.org"},{"time":"2026-06-16T00:00:00.000Z","lang":"en","value":"Advanced notice given to supported customers and distributions"},{"time":"2026-06-24T00:00:00.000Z","lang":"en","value":"Public announcement and release of libreswan 5.3.1"}],"taxonomyMappings":[{"taxonomyName":"ATT&CK","taxonomyVersion":"15.1","taxonomyRelations":[{"taxonomyId":"T1499.004","relationshipName":"maps to","relationshipValue":"Application or System Exploitation (DoS)"}]}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-06T18:12:17.199605Z","id":"CVE-2026-50721","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-07T17:01:58.011Z"}}]}}}