Critical Security Flaw in Libreswan: Denial of Service Vulnerabilities and Assertion Failures
Summary
ALSA-2026:46396: Important: libreswan security update. Affects libreswan versions < 4.12-2.el8_10.6. Fixed in 4.12-2.el8_10.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Libreswan is a robust implementation of IPsec and IKE protocols for Linux, designed to provide secure communication over untrusted networks, such as VPNs. It employs strong cryptographic techniques to ensure both authentication and encryption, making it a vital component for secure data transmission. However, recent vulnerabilities have been identified that could compromise its reliability and security.
Vulnerability Detail
The vulnerabilities in Libreswan include multiple Denial of Service (DoS) issues stemming from improper handling of authentication payloads and malformed data. Specifically, CVE-2026-50721 and CVE-2026-50722 expose the system to DoS attacks via RSA-SHA1 authentication payloads in IKEv1 and IKEv2, respectively. Additionally, CVE-2026-12413 allows for DoS through malformed fragmentation, while CVE-2026-14957 can lead to assertion failures and crashes due to badly formatted X.509 certificates. These vulnerabilities could lead to service disruptions and potential unauthorized access to sensitive data.
How To Fix
Minimum fixed version
4.12-2.el8_10.6
This is the first release that contains the fix.
sudo dnf update libreswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the Libreswan service or implement firewall rules to restrict traffic until the update is applied. However, this is not a permanent solution and should be followed by an update as soon as possible.
Conclusion
The identified vulnerabilities in Libreswan pose significant risks, including potential Denial of Service attacks and service disruptions. It is crucial to update to the latest patched version to ensure the security and reliability of your systems. Regular monitoring and vulnerability assessments are recommended to maintain a secure environment.
See every vulnerability recorded for libreswan →
FAQ
Libreswan is an open-source implementation of IPsec and IKE for Linux, providing secure communication over potentially untrusted networks.
The main vulnerabilities include Denial of Service attacks via RSA-SHA1 authentication payloads and assertion failures due to malformed X.509 certificates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing firewall rules to restrict access to the service as a temporary workaround.
For more details, refer to the CVE pages linked in the advisory, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
