CVE-2026-50722

A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v1_5 scheme. The RSA_authenticate_hash_signature_pkcs1_1_5_rsa() function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted IKEv2 AUTH payload with a shorter-than-expected hash value. This triggers an internal assertion failure, causing the Libreswan daemon to abort and restart, leading to a Denial of Service (DoS).

Furthermore, if the Libreswan gateway accepts connections using weak public RSA exponents (such as e=3), an attacker could execute a Bleichenbacher-style signature forgery attack to achieve an authentication bypass.

Red Hat Product Security rates this as having an Moderate security impact. This Moderate severity rating reflects the deployment reality on modern enterprise platforms. The worst-case authentication bypass vector is effectively non-exploitable due to system-wide Crypto-Policies that strictly block the weak RSA exponents required for the attack. Furthermore, the resulting Denial of Service is limited to a controlled process abort via an internal assertion check. Because the Libreswan service is natively managed by systemd with automatic fault-recovery rules enabled by default, the daemon will instantly restart following a crash. Consequently, a sustained outage requires a continuous and high-volume malicious packet flood, significantly lowering the real-world operational risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If upgrading to Libreswan is not immediately feasible, this vulnerability can be mitigated by enforcing modern signature algorithms, which effectively prevents Libreswan from falling back to the vulnerable legacy parser logic.

Explicitly configure your authby (or leftauth/rightauth) parameters in /etc/ipsec.conf to exclusively permit ECDSA and RSASSA-PSS: authby=ecdsa,rsa-sha2

Note: Applying this mitigation will drop compatibility with native Windows VPN clients that do not support RSASSA-PSS.