CVE-2026-50722 IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload
Remote attackers can cause a denial of service in Libreswan by sending malformed IKEv2 authentication payloads, triggering an assertion failure and daemon restart.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50722?
CVE-2026-50722 is a high-severity denial of service vulnerability in The Libreswan Project libreswan, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017). A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service. The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible. X.509 certificate verifications of the remote IKE peer are not affected.
Which versions are affected by CVE-2026-50722?
It affects 1 product.
Products include Libreswan Libreswan.
How do I fix CVE-2026-50722?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-50722 being exploited?
There is no known exploitation of CVE-2026-50722 in the wild and no public exploit code.
Other vulnerabilities in The Libreswan Project libreswan
Sources
Also known as AZL-91776, CLSA-2026-1784131746, DEBIAN-CVE-2026-50722, GHSA-h4cv-5vw8-2p6m, UBUNTU-CVE-2026-50722.