Critical Security Flaw in Libreswan: Denial of Service Vulnerabilities
Summary
ALSA-2026:46397: Important: libreswan security update. Affects libreswan versions < 4.15-10.el9_8. Fixed in 4.15-10.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Libreswan is a robust implementation of IPsec and IKE for Linux, designed to provide secure communication over untrusted networks such as VPNs. It employs strong cryptography to ensure both authentication and encryption, making it a vital tool for secure data transmission. However, recent vulnerabilities have been identified that could compromise its integrity and availability.
Vulnerability Detail
The vulnerabilities in Libreswan include multiple Denial of Service (DoS) issues stemming from improper handling of authentication payloads and malformed certificates. Specifically, CVE-2026-50721 and CVE-2026-50722 expose the system to DoS attacks via RSA-SHA1 authentication payloads, while CVE-2026-12413 allows for DoS through malformed fragmentation. Additionally, CVE-2026-14957 can lead to assertion failures and crashes due to badly formatted X.509 certificates. These vulnerabilities can disrupt service availability and potentially expose sensitive data.
How To Fix
Minimum fixed version
4.15-10.el9_8
This is the first release that contains the fix.
sudo dnf update libreswanTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling IKEv1 and IKEv2 protocols if they are not essential for your operations, or implement strict input validation to mitigate the risk of malformed packets causing disruptions.
Conclusion
The identified vulnerabilities in Libreswan pose significant risks to the availability and security of services relying on this package. It is crucial to apply the necessary updates promptly and consider workarounds to mitigate potential impacts until the update can be implemented.
See every vulnerability recorded for libreswan →
FAQ
Libreswan is an open-source implementation of IPsec and IKE for Linux, providing secure communication channels over potentially insecure networks.
The vulnerabilities can lead to Denial of Service attacks, causing the Libreswan service to crash and become unavailable, which can disrupt secure communications.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If immediate updates are not possible, consider implementing workarounds such as disabling vulnerable protocols or enhancing input validation to reduce risk.
Related vulnerabilities
Recent vulnerabilities recorded for libreswan.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.