Quick answers
- Is CVE-2026-14957 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-14957 being exploited in the wild.
- How severe is CVE-2026-14957?
- High severity, with a CVSS score of 7.5, published 2 September 2026.
- Which products and versions are affected?
- Libreswan Libreswan.
- Is there a fix for CVE-2026-14957?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-14957 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-14957?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a denial-of-service assertion failure in Libreswan's add_decoded_cert() function. The function calls CERT_ExtractPublicKey() without properly validating the return value; if public key extraction fails (e.g., when an RSA exponent is 0), the function asserts that the result is non-NULL, causing an unhandled assertion and daemon crash. The attack requires sending a malformed CERT payload in an IKE protocol message, which is processed before peer authentication—no credentials are needed. The vulnerability only affects systems running both the OS and Libreswan in FIPS mode with at least one CA certificate loaded in the NSS database; configurations using only PSK authentication without CA certificates are unaffected. Both IKEv1 and IKEv2 protocols are vulnerable.
Affected products
- Libreswan Libreswan
Timeline
- 2026-09-02: disclosed: CVE-2026-14957 published on NVD