RHSA-2026:46396HighCVSS 7.5

Red Hat Security Advisory: libreswan security update

Published
July 27, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (4)

CVE-2026-12413 →CVE-2026-14957 · pendingCVE-2026-50721 →CVE-2026-50722 →

📋 Description

CVE-2026-12413 — librenswan: IKEv2 Denial of Service via malformed fragmentation CVE-2026-14957 — libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process CVE-2026-50721 — librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload CVE-2026-50722 — librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload

🎯 Affected products14

  • Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-0:4.12-2.el8_10.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-0:4.12-2.el8_10.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-0:4.12-2.el8_10.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-0:4.12-2.el8_10.6.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-0:4.12-2.el8_10.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-debuginfo-0:4.12-2.el8_10.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-debuginfo-0:4.12-2.el8_10.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-debuginfo-0:4.12-2.el8_10.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-debuginfo-0:4.12-2.el8_10.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-debugsource-0:4.12-2.el8_10.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-debugsource-0:4.12-2.el8_10.6.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-debugsource-0:4.12-2.el8_10.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • libreswan-debugsource-0:4.12-2.el8_10.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: If upgrading to Libreswan is not an option, you can mitigate the vulnerability by disabling IKEv2 fragment processing: Add the following directive to your global or connection-specific configuration files in /etc/ipsec.conf: ```fragmentation=no``` Warning: Disabling fragmentation may cause larger IKEv2 payloads (such as those carrying large X.509 certificate chains) to be dropped by intermediate network routers if they exceed the path MTU. Workaround: No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security updates once they become available. Workaround: To mitigate this vulnerability, consider the following strategic workarounds if upgrading Libreswan immediately is not viable: - Migrate to IKEv2: Disable IKEv1 entirely and migrate all connections to IKEv2. The vulnerable code path is tied specifically to IKEv1’s rigid handling of PKCS#1 v1.5 RSA-SHA1. - Switch to Pre-Shared Keys (PSK): Additionally, if the configuration is for static tunnels, and not for a group of Remote Access VPN Clients, the authentication can be changed to use PSK via "authby=secret" after coordination with the remote peer. Workaround: If upgrading to Libreswan is not immediately feasible, this vulnerability can be mitigated by enforcing modern signature algorithms, which effectively prevents Libreswan from falling back to the vulnerable legacy parser logic. Explicitly configure your authby (or leftauth/rightauth) parameters in /etc/ipsec.conf to exclusively permit ECDSA and RSASSA-PSS: ```authby=ecdsa,rsa-sha2``` Note: Applying this mitigation will drop compatibility with native Windows VPN clients that do not support RSASSA-PSS.

🔗 References (7)