Vulnerability-Lookup

GHSA-X2HF-3RGR-R89X

Vulnerability from github – Published: 2026-09-02 03:31 – Updated: 2026-09-02 03:31

Details

In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-14957"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-252"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T03:16:47Z",
    "severity": "HIGH"
  },
  "details": "In FIPS mode, Libreswan\u0027s add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.",
  "id": "GHSA-x2hf-3rgr-r89x",
  "modified": "2026-09-02T03:31:13Z",
  "published": "2026-09-02T03:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14957"
    },
    {
      "type": "WEB",
      "url": "https://libreswan.org/security/CVE-2026-14957"
    },
    {
      "type": "WEB",
      "url": "https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-14957 (GCVE-0-2026-14957)

Vulnerability from cvelistv5 – Published: 2026-09-02 02:19 – Updated: 2026-09-02 02:19

Title

FIPS mode assertion failure via malicious CERT payload

Summary

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-617 - Reachable Assertion
CWE-252 - Unchecked Return Value

Assigner

libreswan mitre root

References

2 references

URL	Tags
https://libreswan.org/security/CVE-2026-14957/CVE…	vendor-advisory
https://libreswan.org/security/CVE-2026-14957/	patch

Impacted products

1 product

Vendor	Product	Version
The Libreswan Project	libreswan	Affected: 3.0 , ≤ 5.3.1 (semver) Unaffected: 5.3.2 (semver)

Credits

Claude (Anthropic) Guillaume Winter

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/libreswan/libreswan",
          "defaultStatus": "unaffected",
          "packageName": "libreswan",
          "product": "libreswan",
          "programRoutines": [
            {
              "name": "add_decoded_cert"
            }
          ],
          "repo": "https://github.com/libreswan/libreswan",
          "vendor": "The Libreswan Project",
          "versions": [
            {
              "lessThanOrEqual": "5.3.1",
              "status": "affected",
              "version": "3.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.3.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Exploitation is only possible when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. Both IKEv1 and IKEv2 are vulnerable. Configurations using only PreSharedKey (PSK) authentication with no CA certificates in the NSS database are not vulnerable. Use \u0027sudo ipsec fipsstatus\u0027 to check FIPS mode and \u0027sudo ipsec listcacerts\u0027 to check for loaded CA certificates."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude (Anthropic)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Guillaume Winter"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In FIPS mode, Libreswan\u0027s add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "No known exploitation in the wild. Exploitation requires the target to be running in FIPS mode with at least one CA certificate loaded. The CERT payload can be sent before peer authentication, so no credentials are needed."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-463",
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of Service via assertion failure in pluto daemon when processing a malformed X.509 certificate CERT payload in FIPS mode"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "other": {
            "content": {
              "description": "Vendor-assessed severity: Medium. Exploitation requires FIPS mode to be enabled on both the OS and libreswan, and at least one CA certificate to be loaded. The daemon automatically restarts after the crash, requiring continued exploitation for sustained denial of service.",
              "value": "MEDIUM"
            },
            "type": "vendorSeverity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-617",
              "description": "CWE-617: Reachable Assertion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-252",
              "description": "CWE-252: Unchecked Return Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T02:19:00.114Z",
        "orgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
        "shortName": "libreswan"
      },
      "references": [
        {
          "name": "Libreswan Security Advisory CVE-2026-14957",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt"
        },
        {
          "name": "Libreswan CVE-2026-14957 Patches",
          "tags": [
            "patch"
          ],
          "url": "https://libreswan.org/security/CVE-2026-14957/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to libreswan 5.3.2 or later. Patches for libreswan 4.15 and 5.3 are available at https://libreswan.org/security/CVE-2026-14957/"
        }
      ],
      "source": {
        "defects": [
          "CVE-2026-14957"
        ],
        "discovery": "EXTERNAL"
      },
      "taxonomyMappings": [
        {
          "taxonomyName": "ATT\u0026CK",
          "taxonomyRelations": [
            {
              "relationshipName": "maps to",
              "relationshipValue": "Application or System Exploitation (DoS)",
              "taxonomyId": "T1499.004"
            }
          ],
          "taxonomyVersion": "15.1"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-17T00:00:00.000Z",
          "value": "Guillaume Winter shared a Claude audit review"
        },
        {
          "lang": "en",
          "time": "2026-07-09T00:00:00.000Z",
          "value": "Advanced notice given to supported customers and distributions"
        },
        {
          "lang": "en",
          "time": "2026-07-15T00:00:00.000Z",
          "value": "Public announcement and release of libreswan 5.3.2"
        }
      ],
      "title": "FIPS mode assertion failure via malicious CERT payload",
      "workarounds": [
        {
          "lang": "en",
          "value": "No workaround is available unless one is willing to disable FIPS mode. If libreswan is only using PreSharedKey (PSK) authentication and the NSS database contains no CA certificates, CERT payloads are ignored and libreswan is not vulnerable."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d42dc95b-23f1-4e06-9076-20753a0fb0df",
    "assignerShortName": "libreswan",
    "cveId": "CVE-2026-14957",
    "datePublished": "2026-09-02T02:19:00.114Z",
    "dateReserved": "2026-07-07T13:39:23.932Z",
    "dateUpdated": "2026-09-02T02:19:00.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-X2HF-3RGR-R89X

CVE-2026-14957 (GCVE-0-2026-14957)

Tags

Sightings

Nomenclature