{"id":"CVE-2026-50722","state":"PUBLISHED","title":"IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload","description":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.","publishedAt":"2026-07-02T21:34:41.413Z","updatedAt":"2026-07-07T17:02:06.722Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"libreswan"},"assigner":"libreswan","products":["The Libreswan Project libreswan"],"affected":[{"vendor":"The Libreswan Project","product":"libreswan","packageName":"libreswan","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.3","versionType":"semver"},{"version":"5.3.1","status":"unaffected","versionType":"semver"}],"collectionURL":"https://github.com/libreswan/libreswan","repo":"https://github.com/libreswan/libreswan","programRoutines":[{"name":"RSA_authenticate_hash_signature_pkcs1_1_5_rsa"}]}],"references":["https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt","https://libreswan.org/security/CVE-2026-50722/","https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt","https://www.rfc-editor.org/rfc/rfc8017"],"weaknesses":["CWE-347","CWE-617"],"ingestedAt":"2026-10-29T20:12:16.098Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/50xxx/CVE-2026-50722.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-50722","state":"PUBLISHED","datePublished":"2026-07-02T21:34:41.413Z","dateUpdated":"2026-07-07T17:02:06.722Z","assignerShortName":"libreswan","assignerOrgId":"d42dc95b-23f1-4e06-9076-20753a0fb0df","dateReserved":"2026-06-05T16:10:05.751Z"},"containers":{"cna":{"title":"IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload","descriptions":[{"lang":"en","value":"Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected."}],"affected":[{"vendor":"The Libreswan Project","product":"libreswan","packageName":"libreswan","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.3","versionType":"semver"},{"version":"5.3.1","status":"unaffected","versionType":"semver"}],"collectionURL":"https://github.com/libreswan/libreswan","repo":"https://github.com/libreswan/libreswan","programRoutines":[{"name":"RSA_authenticate_hash_signature_pkcs1_1_5_rsa"}]}],"references":[{"url":"https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt","name":"Libreswan Security Advisory CVE-2026-50722","tags":["vendor-advisory"]},{"url":"https://libreswan.org/security/CVE-2026-50722/","name":"Libreswan CVE-2026-50722 Patches","tags":["patch"]},{"url":"https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt","name":"Related: CVE-2026-50721 (IKEv1 variant)","tags":["related"]},{"url":"https://www.rfc-editor.org/rfc/rfc8017","name":"RFC 8017 - PKCS #1: RSA Cryptography Specifications Version 2.2","tags":["technical-description"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"Weak RSA exponent (e=3) in use, enabling Bleichenbacher signature forgery"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"other":{"type":"vendorSeverity","content":{"value":"MEDIUM","description":"Vendor-assessed severity: Medium. Authentication bypass requires weak RSA exponents (e=3) which have been disallowed by most cryptographic libraries for over a decade. DoS is mitigated by automatic daemon restart."}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-347","lang":"en","type":"CWE","description":"CWE-347: Improper Verification of Cryptographic Signature"}]},{"descriptions":[{"cweId":"CWE-617","lang":"en","type":"CWE","description":"CWE-617: Reachable Assertion"}]}],"providerMetadata":{"shortName":"libreswan","orgId":"d42dc95b-23f1-4e06-9076-20753a0fb0df","dateUpdated":"2026-07-02T21:34:41.413Z"},"impacts":[{"capecId":"CAPEC-463","descriptions":[{"lang":"en","value":"Denial of Service via assertion failure in pluto daemon when processing malformed RSA PKCS#1 v1.5 AUTH payloads"}]},{"capecId":"CAPEC-473","descriptions":[{"lang":"en","value":"Authentication bypass via Bleichenbacher-style signature forgery when weak RSA exponents (e.g., e=3) are in use"}]}],"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>If Windows support is not needed, configure <code>authby=ecdsa</code> or <code>authby=rsa-sha2</code> (or both via <code>authby=ecdsa,rsa-sha2</code>) to disallow the fallback of RSA PKCS#1 1.5. The <code>leftauth=</code> and <code>rightauth=</code> settings can be updated similarly if those are in use instead of <code>authby</code>.</p>"}],"value":"If Windows support is not needed, configure authby=ecdsa or authby=rsa-sha2 (or both via authby=ecdsa,rsa-sha2) to disallow the fallback of RSA PKCS#1 1.5. The leftauth= and rightauth= settings can be updated similarly if those are in use instead of authby."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at <a href=\"https://libreswan.org/security/CVE-2026-50722/\">https://libreswan.org/security/CVE-2026-50722/</a></p>"}],"value":"Upgrade to libreswan 5.3.1 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-50722/"}],"exploits":[{"lang":"en","value":"No known exploitation in the wild. The authentication bypass requires the target to use RSA keys with weak exponents (e=3), which have been disallowed by most cryptographic libraries for at least a decade. The denial-of-service attack is exploitable against any IKEv2 configuration using default authby= settings that permit RSA PKCS#1 v1.5 fallback."}],"configurations":[{"lang":"en","value":"Any server or client that accepts RSA-based IKEv2 connections via the default authby= settings is vulnerable to denial of service. Authentication bypass additionally requires the use of RSA keys with weak exponents (e=3). IKEv2 by default allows ECDSA, RSA-SSA-PSS, and RSA PKCS#1 1.5 as fallback due to Microsoft Windows not supporting RSASSA-PSS."}],"credits":[{"lang":"en","type":"finder","value":"Yeonghyeon Choi"},{"lang":"en","type":"finder","value":"Duyeong Kim"},{"lang":"en","type":"analyst","value":"Andrew Cagney (The Libreswan Team)"}],"source":{"discovery":"EXTERNAL","defects":["CVE-2026-50722"]},"timeline":[{"time":"2026-03-24T00:00:00.000Z","lang":"en","value":"Libreswan notified of the issue via security@libreswan.org"},{"time":"2026-06-16T00:00:00.000Z","lang":"en","value":"Advanced notice given to supported customers and distributions"},{"time":"2026-06-24T00:00:00.000Z","lang":"en","value":"Public announcement and release of libreswan 5.3.1"}],"taxonomyMappings":[{"taxonomyName":"ATT&CK","taxonomyVersion":"15.1","taxonomyRelations":[{"taxonomyId":"T1499.004","relationshipName":"maps to","relationshipValue":"Application or System Exploitation (DoS)"}]}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-06T18:12:19.317302Z","id":"CVE-2026-50722","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-07T17:02:06.722Z"}}]}}}