Executive brief
Libreswan, a tool used to create secure VPN connections, contains a vulnerability in how it handles certain encrypted authentication messages. An attacker could exploit this to crash the VPN service, causing a denial of service, or potentially bypass authentication if the system uses older, weak security keys. This could allow unauthorized access to the network or disrupt secure communications for all users.
Technical details
A vulnerability exists in Libreswan's RSA_authenticate_hash_signature_raw_rsa() function due to improper verification of the authentication hash length in IKEv1 SIG payloads (RFC 2313). A remote, unauthenticated attacker can trigger a reachable assertion by providing a shorter-than-expected hash, resulting in a daemon crash and sustained denial-of-service upon repeated exploitation. Furthermore, if small public exponents (e.g., e=3) are utilized, a variation of the Bleichenbacher attack can be employed to forge signatures and bypass authentication. This issue is specific to IKEv1 RSA-SHA1 authentication and does not affect X.509 certificate verifications. The vulnerability is addressed in version 5.3.1.
Affected products
- The Libreswan Project libreswan versions up to and including 5.3
Timeline
- 2026-03-24: disclosed: Vulnerability reported to Libreswan Project
- 2026-06-16: other: Advanced notice provided to customers and distributions
- 2026-06-24: patched: Public announcement and release of version 5.3.1
- 2026-07-02: advisory: NVD publication date