Executive brief
Libreswan is an open-source IPsec implementation used to create secure VPN connections. In FIPS mode, the software crashes when processing a specially crafted X.509 certificate with an invalid RSA exponent. An unauthenticated remote attacker can repeatedly trigger this crash to cause service disruptions, but cannot gain code execution or access sensitive data.
Technical details
The vulnerability is a denial-of-service assertion failure in Libreswan's add_decoded_cert() function. The function calls CERT_ExtractPublicKey() without properly validating the return value; if public key extraction fails (e.g., when an RSA exponent is 0), the function asserts that the result is non-NULL, causing an unhandled assertion and daemon crash. The attack requires sending a malformed CERT payload in an IKE protocol message, which is processed before peer authentication—no credentials are needed. The vulnerability only affects systems running both the OS and Libreswan in FIPS mode with at least one CA certificate loaded in the NSS database; configurations using only PSK authentication without CA certificates are unaffected. Both IKEv1 and IKEv2 protocols are vulnerable.
Affected products
- Libreswan Libreswan
Timeline
- 2026-09-02: disclosed: CVE-2026-14957 published on NVD