Description
In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_ExtractPublicKey() returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, causing the pluto daemon to abort and restart. Continued exploitation causes a denial of service. No remote code execution is possible. Both IKEv1 and IKEv2 are affected. The vulnerability is only exploitable when both the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. The CERT payload is processed before peer authentication, so no credentials are needed to exploit this. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Libreswan Project | libreswan | 3.0 – ≤ 5.3.1 | 5.3.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | libreswan | No fix yet | — |
| Debian 12 | libreswan | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libreswan | No fix yet | — |
| Ubuntu 26.04 LTS | libreswan | No fix yet | — |
| Ubuntu 24.04 LTS | libreswan | No fix yet | — |
| Ubuntu 22.04 LTS | libreswan | No fix yet | — |
| Ubuntu 20.04 LTS | libreswan | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libreswan | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | libreswan +1 | 5.3.2-1.el10_2 | RHSA-2026:46398 |
| RHEL 9 | libreswan | 4.15-10.el9_8 | RHSA-2026:46986, RHSA-2026:46397 |
| RHEL 8 | libreswan | 4.12-2.el8_10.6 | RHSA-2026:46396 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | libreswan | 5.2-1.el10_0.5 | RHSA-2026:55449 |
| RHEL 9.6 EUS | libreswan | 4.15-8.el9_6.1 | RHSA-2026:57741 |
| RHEL 9.4 E4S | libreswan | 4.12-3.el9_4.2 | RHSA-2026:61258 |
| RHEL 9.2 E4S | libreswan | 4.9-5.el9_2.5 | RHSA-2026:61779 |
| RHEL 8.8 TUS | libreswan | 4.9-3.el8_8.3 | RHSA-2026:72287 |
| RHEL 8.8 E4S | libreswan | 4.9-3.el8_8.3 | RHSA-2026:72287 |
| RHEL 8.6 EUS Long Life | libreswan | 4.5-1.el8_6.6 | RHSA-2026:82154 |
| RHEL 8.6 AUS | libreswan | 4.5-1.el8_6.6 | RHSA-2026:82154 |
| RHEL 8.4 EUS Long Life | libreswan | 4.3-6.el8_4.2 | RHSA-2026:84887 |
| RHEL 8.4 AUS | libreswan | 4.3-6.el8_4.2 | RHSA-2026:84887 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | libreswan +1 | 5.3.2-1.el10_2 | ALSA-2026:46398 |
| AlmaLinux 9 | libreswan | 4.15-10.el9_8 | ALSA-2026:46397 |
| AlmaLinux 8 | libreswan | 4.12-2.el8_10.6 | ALSA-2026:46396 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | libreswan | 5.3.2-1.el10_2 | RLSA-2026:46398 |
| Rocky Linux 9 | libreswan | 4.15-10.el9_8 | RLSA-2026:46397 |
| Rocky Linux 8 | libreswan | 4.12-2.el8_10.6 | RLSA-2026:46396 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libreswan | 5.3.2-r0 | — |
| Alpine v3.23 | libreswan | 5.3.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | libreswan | 4.12-3.amzn2023.0.5 | ALAS2023-2026-3377 |
| Amazon Linux 2 | libreswan | 3.25-4.8.amzn2.0.5 | ALAS2-2026-4068 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libreswan | 4.15-3 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | libreswan +1 | 5.3.2-1.el10_2 | ELSA-2026-46398 |
| Oracle Linux 9 | libreswan | 4.15-10.0.1.el9_8 | ELSA-2026-46397 |
| Oracle Linux 8 | libreswan | 4.12-2.0.1.el8_10.6 | ELSA-2026-46396 |
Advisories 23
- ALAS2023-2026-3377 Moderate: libreswan security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2-2026-4068 Moderate: libreswan security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 2, 2026
- WID-SEC-2026-2518 Red Hat Enterprise Linux (libreswan): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 1, 2026
- ALSA-2026:46397 Important: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:46398 Important: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:46396 Important: libreswan security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:84887 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:82154 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:72287 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:61779 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:61258 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:57741 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55449 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:46986 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:46397 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:46398 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:46396 Red Hat Security Advisory: libreswan security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RLSA-2026:46398 Important: libreswan security update Rocky Linux Security Advisories · Jul 28, 2026
- RLSA-2026:46396 Important: libreswan security update Rocky Linux Security Advisories · Jul 28, 2026
- RLSA-2026:46397 Important: libreswan security update Rocky Linux Security Advisories · Jul 27, 2026
- ELSA-2026-46398 Important: libreswan security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 27, 2026
- ELSA-2026-46397 Important: libreswan security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 27, 2026
- ELSA-2026-46396 Important: libreswan security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 27, 2026
References
- Libreswan Security Advisory CVE-2026-14957 vendor-advisory
- Libreswan CVE-2026-14957 Patches patch