CVE-2026-50721 IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload
Remote attackers can cause denial of service in Libreswan by sending malformed IKEv1 packets with specific RSA signatures, requiring small public exponents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50721?
CVE-2026-50721 is a high-severity denial of service vulnerability in The Libreswan Project libreswan, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of the authentication hash when the SIG payload of an IKEv1 packet was encoded using PKCS #1 RSA Encryption as per RFC 2313. A remote attacker can use a variation on the Bleichenbacher attack to forge the SIG payload when small public exponents are being used (e.g., e=3), which could lead to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the SIG payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of remote IKE peers are not affected.
Which versions are affected by CVE-2026-50721?
It affects 1 product.
Products include Libreswan Libreswan.
How do I fix CVE-2026-50721?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-50721 being exploited?
There is no known exploitation of CVE-2026-50721 in the wild and no public exploit code.
Other vulnerabilities in The Libreswan Project libreswan
Sources
Also known as AZL-91773, CLSA-2026-1784306624, DEBIAN-CVE-2026-50721, GHSA-93pj-2pmf-2x7p, UBUNTU-CVE-2026-50721.