CVE-2026-14957: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-14957 is a reachable assertion (denial of service) vulnerability in Libreswan's X.509 certificate processing path when operating in FIPS mode. It affects Libreswan versions 3.0 through 5.3.1; version 5.3.2 and later are unaffected. The vulnerability was first reported on July 15, 2026, with Red Hat patches issued on July 27, 2026, and NVD publication on September 2, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, GitHub Advisory).

The root cause is a combination of an unchecked return value (CWE-252) and a reachable assertion (CWE-617) in the add_decoded_cert() function. This function calls CERT_ExtractPublicKey() and unconditionally asserts the result is non-NULL; however, CERT_ExtractPublicKey() legitimately returns NULL when public key extraction fails — for example, when processing an X.509 certificate with an RSA exponent of zero. An unauthenticated remote attacker can craft a malformed CERT payload containing such a certificate and send it during an IKEv1 or IKEv2 exchange, triggering the assertion and causing the pluto daemon to abort and restart. Exploitation requires that both the OS and Libreswan are running in FIPS mode and that at least one CA certificate is loaded in the NSS database; PSK-only configurations without loaded CA certificates are not vulnerable (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation causes the Libreswan pluto IKE daemon to crash and restart, resulting in a denial of service for all active and pending VPN connections. Repeated exploitation can sustain a persistent denial of service condition, preventing legitimate VPN tunnel establishment. There is no confidentiality or integrity impact, and no remote code execution is possible (Red Hat CVE, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been observed as of the time of reporting (GitHub Advisory). The vulnerability is network-exploitable with low attack complexity, requires no privileges or user interaction, and is automatable according to NVD SSVC analysis. The EPSS score is approximately 0.555% (45th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE).

1. Reconnaissance: Identify internet-facing or network-accessible hosts running Libreswan in FIPS mode (versions 3.0–5.3.1) with at least one CA certificate loaded in the NSS database, using network scanning tools targeting IKE ports (UDP 500, UDP 4500).
2. Craft malformed X.509 certificate: Construct a malformed X.509 certificate with an RSA public key exponent set to zero (or another value that causes CERT_ExtractPublicKey() to return NULL).
3. Embed in CERT payload: Package the malformed certificate into an IKE CERT payload, which is valid for both IKEv1 and IKEv2 exchanges.
4. Send unauthenticated IKE exchange: Initiate an IKEv1 or IKEv2 exchange with the target and transmit the crafted CERT payload — no credentials are required, as the CERT payload is processed before peer authentication.
5. Trigger assertion failure: The add_decoded_cert() function calls CERT_ExtractPublicKey(), receives NULL, and hits the assertion, causing the pluto daemon to abort and restart.
6. Sustain denial of service: Repeat the exchange continuously to prevent the daemon from recovering and maintaining VPN service (Red Hat Bugzilla, GitHub Advisory).

• Network: Repeated unauthenticated IKE connection attempts (UDP 500/4500) from unexpected source IPs, particularly those that do not complete a full IKE handshake.
• Logs: Repeated pluto daemon crash/restart entries in /var/log/pluto.log or system journal (e.g., assertion failed, CERT_ExtractPublicKey returned NULL); systemd or init logs showing frequent ipsec/pluto service restarts.
• Process: Unexpected or frequent restarts of the pluto process observable via ps, systemctl status ipsec, or process monitoring tools.
• File System: Core dump files generated by the pluto process in configured core dump directories, timestamped around the time of suspected exploitation (Red Hat Bugzilla).

The primary remediation is to upgrade Libreswan to version 5.3.2 or later, which resolves the assertion failure by properly checking the return value of CERT_ExtractPublicKey() (GitHub Advisory). Red Hat has issued patches for multiple RHEL versions: RHSA-2026:46396 (RHEL 8), RHSA-2026:46397 (RHEL 9), RHSA-2026:46398 (RHEL 10), RHSA-2026:46986 (Fast Datapath for RHEL 9), and additional EUS/SAP and OpenShift Container Platform errata (Red Hat Bugzilla). As a workaround, organizations that do not require certificate-based authentication can switch to PSK-only authentication and remove all CA certificates from the NSS database, which eliminates the vulnerable code path. Network segmentation and firewall rules restricting IKE traffic (UDP 500/4500) to trusted peers can also reduce exposure.

The Libreswan project published an official security advisory at libreswan.org/security/CVE-2026-14957/ (GitHub Advisory). Red Hat issued multiple errata across RHEL 8, 9, 10, and OpenShift Container Platform, reflecting broad downstream impact. Coverage appeared in Linux security news outlets including LinuxSecurity.com and Pro-Linux.de, and the vulnerability was noted in the context of Microsoft's September 2026 Patch Tuesday roundup by BleepingComputer. Community discussion was limited, consistent with the absence of public exploit code and the constrained exploitation conditions (FIPS mode + CA certificates required).