SB2026072706 - Red Hat Enterprise Linux 8 update for libreswan
Published: July 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-50721)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in RSA_authenticate_hash_signature_raw_rsa() when processing an invalidly formatted PKCS#1 v1.5 RSA signature in an IKEv1 SIG payload. A remote attacker can send a specially crafted IKEv1 packet with a shorter than expected hash to cause a denial of service.
The issue affects IKEv1 RSA-SHA1 authentication payload handling and can trigger an assertion that causes libreswan to abort and restart.
2) Input validation error (CVE-ID: CVE-2026-50722)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in RSA_authenticate_hash_signature_pkcs1_1_5_rsa() when processing IKEv2 AUTH payloads encoded using RSASSA-PKCS1-v1_5. A remote attacker can send a specially crafted authentication payload to cause a denial of service.
The issue is triggered by a shorter than expected hash in the AUTH payload, which can lead to an assertion failure and process restart.
3) Reachable assertion (CVE-ID: CVE-2026-12413)
CWE-ID: CWE-617 - Reachable Assertion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an assertion failure caused by improper bounds checking in reassemble_v2_incoming_fragments() when processing invalidly formatted IKEv2 fragments. A remote attacker can send specially crafted fragmented IKEv2 packets to cause a denial of service.
Only IKEv2 configurations with fragmentation enabled are vulnerable. IKEv1 is not affected.
4) NULL pointer dereference (CVE-ID: CVE-2026-14957)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of a null return value in certificate public key extraction in programs/pluto/nss_cert_verify.c when processing a malformed X.509 CERT payload in FIPS mode. A remote attacker can send a specially crafted certificate payload to cause a denial of service.
Exploitation is only possible when the OS and libreswan are running in FIPS mode and at least one CA certificate is loaded. CERT payloads can be processed before peer authentication, and both IKEv1 and IKEv2 are affected.
Remediation
Install update from vendor's website.