CVE-2026-50721: 
NixOS vulnerability analysis and mitigation

CVE-2026-50721 is an RSA signature verification flaw in Libreswan's RSA_authenticate_hash_signature_raw_rsa() function that allows unauthenticated remote attackers to forge IKEv1 SIG payloads (impersonation) or trigger a daemon crash (denial of service). It affects all Libreswan versions up to and including 5.3, with version 5.3.1 being the first patched release. The vulnerability was published on July 2, 2026, and is classified as High severity with a CVSS v3.1 base score of 5.9 (per NVD/Feedly) or 8.1 (per GitHub Advisory, which accounts for confidentiality and integrity impacts from impersonation) (GitHub Advisory, Libreswan Advisory).

The root cause is improper verification of cryptographic signature length (CWE-347) combined with a reachable assertion (CWE-617) in the RSA_authenticate_hash_signature_raw_rsa() function. When an IKEv1 SIG payload is encoded using PKCS #1 RSA Encryption (RFC 2313), Libreswan fails to validate that the authentication hash length matches the expected value. This enables two distinct attack paths: (1) a Bleichenbacher-style attack to forge SIG payloads when small RSA public exponents (e.g., e=3) are in use, enabling peer impersonation; and (2) sending a SIG payload with a shorter-than-expected hash to trigger an assertion failure, causing the pluto daemon to abort and restart. X.509 certificate-based verification of remote IKE peers is explicitly not affected by this flaw (GitHub Advisory, Libreswan Advisory).

Successful exploitation can result in two distinct outcomes: impersonation of a legitimate IKE peer (integrity and confidentiality impact) when small RSA public exponents are used, or sustained denial of service via repeated daemon crashes when crafted short-hash SIG payloads are sent. The impersonation vector could allow an attacker to establish unauthorized VPN tunnels, potentially enabling access to protected network segments. Remote code execution is explicitly ruled out by the vendor, and X.509 certificate-based IKE peer verification is unaffected (GitHub Advisory, Libreswan Advisory).

1. Reconnaissance: Identify internet-facing Libreswan IKEv1 endpoints (UDP port 500/4500) using network scanning tools such as Nmap or Shodan. Confirm the target is running Libreswan version 5.3 or earlier.
2. Determine RSA exponent: Obtain or infer the RSA public key of the target IKE peer to determine whether a small public exponent (e.g., e=3) is in use, which is required for the forgery/impersonation path.
3. Forge SIG payload (impersonation path): Craft an IKEv1 packet with a SIG payload encoded using PKCS #1 RSA Encryption (RFC 2313) containing a Bleichenbacher-forged signature. Due to the missing length check, the forged signature passes verification when e=3 is used, allowing the attacker to impersonate a legitimate IKE peer.
4. Trigger DoS (denial-of-service path): Alternatively, craft an IKEv1 packet with a SIG payload containing a hash shorter than expected. Send this to the target; the RSA_authenticate_hash_signature_raw_rsa() function triggers an assertion failure, causing the pluto daemon to abort and restart. Repeat to sustain denial of service.
5. Achieve objective: For impersonation, complete the IKE handshake as the forged peer to establish an unauthorized VPN tunnel. For DoS, continue sending malformed packets to keep the daemon in a crash-restart loop (GitHub Advisory, Libreswan Advisory).

• Network: Unexpected IKEv1 negotiation attempts (UDP port 500/4500) from unknown or untrusted IP addresses; IKEv1 packets with anomalous SIG payload lengths.
• Logs: Repeated pluto daemon crash and restart entries in /var/log/pluto.log or system journal (e.g., pluto[PID]: ABORT or assertion failure messages in RSA_authenticate_hash_signature_raw_rsa); unexpected IKE SA establishment with unfamiliar peer identities.
• Process: Frequent restarts of the pluto process (Libreswan IKE daemon) visible via systemctl status ipsec or process monitoring tools.
• File System: No specific file artifacts expected, as remote code execution is not possible (Libreswan Advisory).

Upgrade Libreswan to version 5.3.1 or later, which correctly validates the authentication hash length in RSA_authenticate_hash_signature_raw_rsa() (Libreswan Advisory, GitHub Advisory). As a configuration-based workaround, avoid using small RSA public exponents (e.g., e=3) for IKE peer authentication to eliminate the Bleichenbacher forgery path; use standard exponents (e.g., e=65537). Monitor Libreswan daemon logs for unexpected restarts as an indicator of active exploitation attempts. Patches are tracked for Debian and Ubuntu distributions via their respective security advisories.

The vulnerability was noted in the Solus Linux community weekly update thread for Week 28, 2026, indicating awareness among Linux distribution maintainers. INCIBE-CERT (Spain's national CERT) published an alert for the related CVE-2026-50722. No significant vendor statements beyond the Libreswan project's own advisory or notable researcher commentary have been identified at this time (Libreswan Advisory).