CVE-2026-14957
Received Received - Intake

Denial of Service in Libreswan via Malformed X.509 Certificate

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Libreswan Project

Description
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-14957
EUVD
EUVD-2026-69820

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
libreswan libreswan From 3.0 (inc) to 5.3.1 (inc)
libreswan libreswan 5.3.2
libreswan libreswan 5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Libreswan occurs when a malformed X.509 certificate triggers an assertion failure in FIPS mode. The add_decoded_cert() function calls CERT_ExtractPublicKey() which returns NULL if public key extraction fails, such as when the RSA exponent is set to 0. An assertion in FIPS mode expects a non-NULL result, causing the pluto daemon to crash and restart. Repeated exploitation leads to a denial of service.

Detection Guidance

To detect this vulnerability, check if your system is running Libreswan in FIPS mode with at least one CA certificate loaded. Verify the version of Libreswan installed. Vulnerable versions are 3.0 through 5.3.1. Run 'ipsec --version' to check the version and 'ipsec whack --fipsstatus' to confirm FIPS mode.

Impact Analysis

This vulnerability can cause your Libreswan VPN service to crash repeatedly, leading to service disruption and potential denial of service. It requires the system and Libreswan to be running in FIPS mode with at least one CA certificate loaded. Exploitation is possible without credentials by sending a malformed certificate in a CERT payload.

Compliance Impact

This vulnerability primarily causes a denial of service by crashing the pluto daemon in FIPS mode when processing malformed certificates. It does not directly impact data confidentiality or integrity, so it is unlikely to violate GDPR or HIPAA requirements directly. However, repeated service disruptions could affect availability, which is a key consideration under both regulations.

Mitigation Strategies

Immediately upgrade Libreswan to version 5.3.2 or later. If upgrading is not possible, apply available patches for versions 4.15 and 5.3. Disable FIPS mode if it is not required, but note this may not be feasible in compliance-required environments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart