High [CVE-2026-50722] IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload

Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v1_5 (RFC 8017).

A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload when small public exponents are used (e.g., e=3), leading to impersonation. Additionally, a remote attacker, by encoding a shorter than expected hash in the AUTH payload, could trigger an assertion leading to denial-of-service.

The daemon aborts and restarts; continued exploitation causes sustained denial of service. Remote code execution is not possible.

X.509 certificate verifications of the remote IKE peer are not affected. A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v1_5 scheme.

A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted IKEv2 AUTH payload with a shorter-than-expected hash value. This triggers an internal assertion failure, causing the Libreswan daemon to abort and restart, leading to a Denial of Service (DoS).

Furthermore, if the Libreswan gateway accepts connections using weak public RSA exponents (such as e=3), an attacker could execute a Bleichenbacher-style signature forgery attack to achieve an authentication bypass.