CVE-2026-14957: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-14957 is a reachable assertion vulnerability in Libreswan's X.509 certificate processing path that allows unauthenticated remote attackers to crash the pluto IKE daemon, resulting in a denial of service. It affects Libreswan versions 3.0 through 5.3.1 when running in FIPS mode with at least one CA certificate loaded in the NSS database. The vulnerability was first reported on July 15, 2026, with patches released by July 17, 2026, and publicly disclosed via NVD on September 2, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, GitHub Advisory).

The root cause is a combination of CWE-617 (Reachable Assertion) and CWE-252 (Unchecked Return Value) in the add_decoded_cert() function. This function calls CERT_ExtractPublicKey() and then asserts the result is non-NULL; however, CERT_ExtractPublicKey() legitimately returns NULL when public key extraction fails — for example, when processing an X.509 certificate with an RSA exponent of zero. An attacker can craft a malformed CERT payload containing such a certificate and send it during an IKEv1 or IKEv2 exchange; because the CERT payload is processed before peer authentication, no credentials are required. The vulnerability is only reachable when both the OS and Libreswan are configured in FIPS mode and at least one CA certificate is loaded in the NSS database; PSK-only configurations without loaded CA certificates are not affected (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation causes the Libreswan pluto daemon to abort and restart, disrupting all active and pending IKE/IPsec VPN sessions on the affected host. Repeated exploitation results in a sustained denial of service, rendering the VPN gateway unavailable. There is no confidentiality or integrity impact, and no remote code execution is possible (Red Hat CVE, GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been observed as of the time of reporting (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.555%, placing it in the 44th percentile for exploitation likelihood within 30 days (GitHub Advisory). Despite the low exploitation evidence, the attack requires no authentication and has low complexity, making it straightforward to trigger in qualifying configurations.

1. Reconnaissance: Identify internet-facing or network-accessible hosts running Libreswan in FIPS mode (e.g., via IKE port scanning on UDP 500/4500 using tools like ike-scan) and confirm they are using certificate-based authentication (indicating CA certificates are likely loaded).
2. Craft malformed X.509 certificate: Generate a malformed X.509 certificate with an RSA public key exponent set to zero using a tool such as OpenSSL or a custom script, which will cause CERT_ExtractPublicKey() to return NULL.
3. Embed in CERT payload: Construct an IKEv1 or IKEv2 CERT payload containing the malformed certificate. This can be done using IKE protocol libraries or custom packet crafting tools.
4. Send to target: Transmit the crafted IKE exchange packet with the malformed CERT payload to the target's UDP port 500 or 4500. No authentication or prior session establishment is required.
5. Trigger assertion failure: The pluto daemon's add_decoded_cert() function processes the CERT payload, calls CERT_ExtractPublicKey(), receives NULL, and hits the assertion, causing the daemon to abort and restart.
6. Sustain DoS: Repeat the process continuously to prevent the daemon from recovering, maintaining a denial-of-service condition (Red Hat Bugzilla, GitHub Advisory).

• Network: Unexpected or repeated IKE negotiation attempts (UDP port 500/4500) from unknown or untrusted source IPs, particularly with malformed or unusual CERT payloads.
• Logs: Repeated pluto daemon crash/restart entries in /var/log/pluto.log or system journal (e.g., pluto[PID]: ABORT or assertion failure messages referencing add_decoded_cert or CERT_ExtractPublicKey); systemd restart events for the ipsec or libreswan service.
• Process: Frequent unexpected restarts of the pluto process visible via ps, systemctl status ipsec, or process monitoring tools.
• File System: Core dump files generated by the pluto process in configured core dump directories, potentially timestamped around the time of suspicious IKE traffic.

Upgrade Libreswan to version 5.3.2 or later, which resolves the assertion failure by properly checking the return value of CERT_ExtractPublicKey() before asserting (Red Hat Bugzilla). Red Hat has issued patches for multiple RHEL versions: RHSA-2026:46396 (RHEL 8), RHSA-2026:46397 (RHEL 9), RHSA-2026:46398 (RHEL 10), RHSA-2026:46986 (Fast Datapath for RHEL 9), and additional EUS/SAP errata (Red Hat CVE). As an interim workaround, organizations can restrict IKE traffic to trusted peers using firewall rules, or switch to PSK-only authentication with no CA certificates loaded in the NSS database, which eliminates the vulnerable code path. Fedora, AlmaLinux, Rocky Linux, Oracle Linux, and Debian have also issued updated packages.

The vulnerability received coverage from Linux security news outlets including LinuxSecurity.com and Pro-Linux.de, which reported on the denial-of-service risk in Libreswan across multiple distributions (Red Hat CVE). BleepingComputer mentioned CVE-2026-14957 in the context of Microsoft's September 2026 Patch Tuesday coverage. Community discussion on Mastodon (via @thehackerwire) and the Solus Linux forums noted the update. No significant controversy or notable researcher commentary beyond standard patch advisories has been observed.