RHSA-2026:46397

Vulnerability from csaf_opensuse - Published: 2026-07-27 03:46 - Updated: 2026-07-27 23:32
Summary
Red Hat Security Advisory: libreswan security update
Severity
Important
Notes
Topic: An update for libreswan is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN). Security Fix(es): * librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721) * librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722) * librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413) * libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-12413

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets (fragments) containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check (assertion failure). A remote, unauthenticated attacker can exploit this by sending a specific sequence of malformed IKEv2 fragments to an exposed gateway, causing the Libreswan daemon to immediately crash and restart. While this flaw does not allow data theft or unauthorized system access, a continuous stream of these packets will lead to a persistent Denial of Service (DoS) for legitimate VPN users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-193 - Off-by-one Error
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-14957

No description is available for this CVE.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-50721

A flaw was found in Libreswan's implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS #1 v1.5 RSA encryption, the RSA_authenticate_hash_signature_raw_rsa() function fails to properly validate the length of the authentication hash. A remote, unauthenticated attacker could exploit this vulnerability by sending a specially crafted IKEv1 packet containing a shorter-than-expected hash payload. This triggers an assertion failure within the Libreswan daemon, causing it to crash and restart, leading to a persistent Denial of Service (DoS) condition if malicious packets are continuously transmitted. Additionally, if the target system relies on RSA keys with weak public exponents (e.g., e=3), a Bleichenbacher-style signature forgery attack may be feasible, potentially allowing the attacker to bypass authentication entirely.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-50722

A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v1_5 scheme. The RSA_authenticate_hash_signature_pkcs1_1_5_rsa() function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted IKEv2 AUTH payload with a shorter-than-expected hash value. This triggers an internal assertion failure, causing the Libreswan daemon to abort and restart, leading to a Denial of Service (DoS). Furthermore, if the Libreswan gateway accepts connections using weak public RSA exponents (such as e=3), an attacker could execute a Bleichenbacher-style signature forgery attack to achieve an authentication bypass.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:46397 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2494147 external
https://bugzilla.redhat.com/show_bug.cgi?id=2494148 external
https://bugzilla.redhat.com/show_bug.cgi?id=2494149 external
https://bugzilla.redhat.com/show_bug.cgi?id=2501764 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-12413 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494149 external
https://www.cve.org/CVERecord?id=CVE-2026-12413 external
https://nvd.nist.gov/vuln/detail/CVE-2026-12413 external
https://libreswan.org/security/CVE-2026-12413/ external
https://libreswan.org/security/CVE-2026-12413/CVE… external
https://lists.libreswan.org/archives/list/swan-an… external
https://access.redhat.com/security/cve/CVE-2026-14957 self
https://bugzilla.redhat.com/show_bug.cgi?id=2501764 external
https://www.cve.org/CVERecord?id=CVE-2026-14957 external
https://nvd.nist.gov/vuln/detail/CVE-2026-14957 external
https://libreswan.org/security/CVE-2026-14957/ external
https://libreswan.org/security/CVE-2026-14957/CVE… external
https://access.redhat.com/security/cve/CVE-2026-50721 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494147 external
https://www.cve.org/CVERecord?id=CVE-2026-50721 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50721 external
https://libreswan.org/security/CVE-2026-50721/ external
https://libreswan.org/security/CVE-2026-50721/CVE… external
https://access.redhat.com/security/cve/CVE-2026-50722 self
https://bugzilla.redhat.com/show_bug.cgi?id=2494148 external
https://www.cve.org/CVERecord?id=CVE-2026-50722 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50722 external
https://libreswan.org/security/CVE-2026-50722 external
https://libreswan.org/security/CVE-2026-50722/ external
https://libreswan.org/security/CVE-2026-50722/CVE… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for libreswan is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks such as virtual private network (VPN).\n\nSecurity Fix(es):\n\n* librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload (CVE-2026-50721)\n\n* librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload (CVE-2026-50722)\n\n* librenswan: IKEv2 Denial of Service via malformed fragmentation (CVE-2026-12413)\n\n* libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process (CVE-2026-14957)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:46397",
        "url": "https://access.redhat.com/errata/RHSA-2026:46397"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2494147",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494147"
      },
      {
        "category": "external",
        "summary": "2494148",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494148"
      },
      {
        "category": "external",
        "summary": "2494149",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494149"
      },
      {
        "category": "external",
        "summary": "2501764",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501764"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46397.json"
      }
    ],
    "title": "Red Hat Security Advisory: libreswan security update",
    "tracking": {
      "current_release_date": "2026-07-27T23:32:18+00:00",
      "generator": {
        "date": "2026-07-27T23:32:18+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:46397",
      "initial_release_date": "2026-07-27T03:46:32+00:00",
      "revision_history": [
        {
          "date": "2026-07-27T03:46:32+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-27T03:46:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-27T23:32:18+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-10.el9_8.src",
                "product": {
                  "name": "libreswan-0:4.15-10.el9_8.src",
                  "product_id": "libreswan-0:4.15-10.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-10.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-10.el9_8.aarch64",
                "product": {
                  "name": "libreswan-0:4.15-10.el9_8.aarch64",
                  "product_id": "libreswan-0:4.15-10.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-10.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debugsource-0:4.15-10.el9_8.aarch64",
                "product": {
                  "name": "libreswan-debugsource-0:4.15-10.el9_8.aarch64",
                  "product_id": "libreswan-debugsource-0:4.15-10.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debugsource@4.15-10.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
                "product": {
                  "name": "libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
                  "product_id": "libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debuginfo@4.15-10.el9_8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-10.el9_8.ppc64le",
                "product": {
                  "name": "libreswan-0:4.15-10.el9_8.ppc64le",
                  "product_id": "libreswan-0:4.15-10.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-10.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
                "product": {
                  "name": "libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
                  "product_id": "libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debugsource@4.15-10.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
                "product": {
                  "name": "libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
                  "product_id": "libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debuginfo@4.15-10.el9_8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-10.el9_8.s390x",
                "product": {
                  "name": "libreswan-0:4.15-10.el9_8.s390x",
                  "product_id": "libreswan-0:4.15-10.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-10.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debugsource-0:4.15-10.el9_8.s390x",
                "product": {
                  "name": "libreswan-debugsource-0:4.15-10.el9_8.s390x",
                  "product_id": "libreswan-debugsource-0:4.15-10.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debugsource@4.15-10.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debuginfo-0:4.15-10.el9_8.s390x",
                "product": {
                  "name": "libreswan-debuginfo-0:4.15-10.el9_8.s390x",
                  "product_id": "libreswan-debuginfo-0:4.15-10.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debuginfo@4.15-10.el9_8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libreswan-0:4.15-10.el9_8.x86_64",
                "product": {
                  "name": "libreswan-0:4.15-10.el9_8.x86_64",
                  "product_id": "libreswan-0:4.15-10.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan@4.15-10.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debugsource-0:4.15-10.el9_8.x86_64",
                "product": {
                  "name": "libreswan-debugsource-0:4.15-10.el9_8.x86_64",
                  "product_id": "libreswan-debugsource-0:4.15-10.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debugsource@4.15-10.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
                "product": {
                  "name": "libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
                  "product_id": "libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/libreswan-debuginfo@4.15-10.el9_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64"
        },
        "product_reference": "libreswan-0:4.15-10.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le"
        },
        "product_reference": "libreswan-0:4.15-10.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-10.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x"
        },
        "product_reference": "libreswan-0:4.15-10.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-10.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src"
        },
        "product_reference": "libreswan-0:4.15-10.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-0:4.15-10.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64"
        },
        "product_reference": "libreswan-0:4.15-10.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debuginfo-0:4.15-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64"
        },
        "product_reference": "libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debuginfo-0:4.15-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le"
        },
        "product_reference": "libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debuginfo-0:4.15-10.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x"
        },
        "product_reference": "libreswan-debuginfo-0:4.15-10.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debuginfo-0:4.15-10.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64"
        },
        "product_reference": "libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debugsource-0:4.15-10.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64"
        },
        "product_reference": "libreswan-debugsource-0:4.15-10.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debugsource-0:4.15-10.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le"
        },
        "product_reference": "libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debugsource-0:4.15-10.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x"
        },
        "product_reference": "libreswan-debugsource-0:4.15-10.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libreswan-debugsource-0:4.15-10.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
        },
        "product_reference": "libreswan-debugsource-0:4.15-10.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-12413",
      "cwe": {
        "id": "CWE-193",
        "name": "Off-by-one Error"
      },
      "discovery_date": "2026-06-29T11:20:53.350000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494149"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Libreswan\u0027s IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets (fragments) containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check (assertion failure). A remote, unauthenticated attacker can exploit this by sending a specific sequence of malformed IKEv2 fragments to an exposed gateway, causing the Libreswan daemon to immediately crash and restart. While this flaw does not allow data theft or unauthorized system access, a continuous stream of these packets will lead to a persistent Denial of Service (DoS) for legitimate VPN users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "librenswan: IKEv2 Denial of Service via malformed fragmentation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this vulnerability as having an Important impact, primarily because it can be exploited remotely without authentication. However, the actual exposure depends entirely on your specific VPN configuration:\n\n```\nAffected Configurations: This vulnerability only impacts IKEv2 connections. By default, Libreswan enables packet fragmentation (fragmentation=yes) to handle large encryption keys over restrictive network paths. Any default IKEv2 tunnel that do not set fragmentation=no are vulnerable.\n\nUnaffected Configurations: IKEv1 connections are completely unaffected by this flaw.\n\n```\n\n```\nCrucially, this vulnerability does not impact environments running Libreswan versions 4.5 and older. The vulnerable fragment reassembly engine was introduced during a major codebase refactor in version 4.6. As a result, older product branches\u2014such as those shipped in rhel-6, rhel-7, rhel-8.6.z and prior do not contain the flawed code path and are inherently immune to this attack.\n\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12413"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494149",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494149"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12413",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12413"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12413",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12413"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-12413/",
          "url": "https://libreswan.org/security/CVE-2026-12413/"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-12413/CVE-2026-12413.txt",
          "url": "https://libreswan.org/security/CVE-2026-12413/CVE-2026-12413.txt"
        },
        {
          "category": "external",
          "summary": "https://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/",
          "url": "https://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/"
        }
      ],
      "release_date": "2026-06-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T03:46:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46397"
        },
        {
          "category": "workaround",
          "details": "If upgrading to Libreswan is not an option, you can mitigate the vulnerability by disabling IKEv2 fragment processing:\n\nAdd the following directive to your global or connection-specific configuration files in /etc/ipsec.conf: ```fragmentation=no```\n\nWarning: Disabling fragmentation may cause larger IKEv2 payloads (such as those carrying large X.509 certificate chains) to be dropped by intermediate network routers if they exceed the path MTU.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "librenswan: IKEv2 Denial of Service via malformed fragmentation"
    },
    {
      "cve": "CVE-2026-14957",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-07-17T11:43:07.159000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2501764"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "No description is available for this CVE.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14957"
        },
        {
          "category": "external",
          "summary": "RHBZ#2501764",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501764"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14957",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14957"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14957",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14957"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-14957/",
          "url": "https://libreswan.org/security/CVE-2026-14957/"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt",
          "url": "https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.txt"
        }
      ],
      "release_date": "2026-07-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T03:46:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46397"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security updates once they become available.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process"
    },
    {
      "cve": "CVE-2026-50721",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-06-29T11:20:06.653000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Libreswan\u0027s implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS #1 v1.5 RSA encryption, the RSA_authenticate_hash_signature_raw_rsa() function fails to properly validate the length of the authentication hash. A remote, unauthenticated attacker could exploit this vulnerability by sending a specially crafted IKEv1 packet containing a shorter-than-expected hash payload. This triggers an assertion failure within the Libreswan daemon, causing it to crash and restart, leading to a persistent Denial of Service (DoS) condition if malicious packets are continuously transmitted.\n\nAdditionally, if the target system relies on RSA keys with weak public exponents (e.g., e=3), a Bleichenbacher-style signature forgery attack may be feasible, potentially allowing the attacker to bypass authentication entirely.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this as having an Moderate security impact, because this vulnerability directly affects the availability of Libreswan VPN gateways utilizing legacy IKEv1 tunnels. IKEv1 is not default in modern RHEL; modern profiles enforce IKEv2. Because the crash occurs during the unauthenticated phase of the IKE negotiation, any exposed Libreswan service (server or client) accepting standard IKEv1 connections via the default (authby=rsasig) option is vulnerable to the Denial of Service aspect of this flaw.   \n\nAdditionally, the risk of the authentication bypass vector is mitigated to low on Red Hat Enterprise Linux due to system-wide Crypto-Policies that strictly disallow the generation and use of keys with weak public exponents. This completely neutralizes the worst-case Authentication Bypass and Impersonation vectors for CVE-2026-50721, confining the threat strictly to a DoS process crash.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50721"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50721",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50721"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50721",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50721"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-50721/",
          "url": "https://libreswan.org/security/CVE-2026-50721/"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt",
          "url": "https://libreswan.org/security/CVE-2026-50721/CVE-2026-50721.txt"
        },
        {
          "category": "external",
          "summary": "https://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/",
          "url": "https://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/"
        }
      ],
      "release_date": "2026-06-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T03:46:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46397"
        },
        {
          "category": "workaround",
          "details": "To mitigate this vulnerability, consider the following strategic workarounds if upgrading Libreswan immediately is not viable:\n\n- Migrate to IKEv2: Disable IKEv1 entirely and migrate all connections to IKEv2. The vulnerable code path is tied specifically to IKEv1\u2019s rigid handling of PKCS#1 v1.5 RSA-SHA1.\n\n- Switch to Pre-Shared Keys (PSK): Additionally, if the configuration is for static tunnels, and not for a group of Remote Access VPN Clients, the authentication can be changed to use PSK via \"authby=secret\" after coordination with the remote peer.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload"
    },
    {
      "cve": "CVE-2026-50722",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-06-29T11:20:53.156000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494148"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Libreswan\u0027s implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v1_5 scheme. The RSA_authenticate_hash_signature_pkcs1_1_5_rsa() function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted IKEv2 AUTH payload with a shorter-than-expected hash value. This triggers an internal assertion failure, causing the Libreswan daemon to abort and restart, leading to a Denial of Service (DoS). \n\nFurthermore, if the Libreswan gateway accepts connections using weak public RSA exponents (such as e=3), an attacker could execute a Bleichenbacher-style signature forgery attack to achieve an authentication bypass.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this as having an Moderate security impact. This Moderate severity rating reflects the deployment reality on modern enterprise platforms. The worst-case authentication bypass vector is effectively non-exploitable due to system-wide Crypto-Policies that strictly block the weak RSA exponents required for the attack. Furthermore, the resulting Denial of Service is limited to a controlled process abort via an internal assertion check. Because the Libreswan service is natively managed by systemd with automatic fault-recovery rules enabled by default, the daemon will instantly restart following a crash. Consequently, a sustained outage requires a continuous and high-volume malicious packet flood, significantly lowering the real-world operational risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50722"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494148",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494148"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50722",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50722"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50722",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50722"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-50722",
          "url": "https://libreswan.org/security/CVE-2026-50722"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-50722/",
          "url": "https://libreswan.org/security/CVE-2026-50722/"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt",
          "url": "https://libreswan.org/security/CVE-2026-50722/CVE-2026-50722.txt"
        },
        {
          "category": "external",
          "summary": "https://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/",
          "url": "https://lists.libreswan.org/archives/list/swan-announce@lists.libreswan.org/thread/7BZBYREBGXFPS4TSWOZX37WABRZVLK74/"
        }
      ],
      "release_date": "2026-06-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-27T03:46:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:46397"
        },
        {
          "category": "workaround",
          "details": "If upgrading to Libreswan is not immediately feasible, this vulnerability can be mitigated by enforcing modern signature algorithms, which effectively prevents Libreswan from falling back to the vulnerable legacy parser logic.\n\nExplicitly configure your authby (or leftauth/rightauth) parameters in /etc/ipsec.conf to exclusively permit ECDSA and RSASSA-PSS: ```authby=ecdsa,rsa-sha2```\n\nNote: Applying this mitigation will drop compatibility with native Windows VPN clients that do not support RSASSA-PSS.",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debuginfo-0:4.15-10.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:libreswan-debugsource-0:4.15-10.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.