CVE-2026-14957 Overview
CVE-2026-14957 is a denial-of-service vulnerability in Libreswan, an open-source IPsec/IKE implementation. The flaw resides in the add_decoded_cert() function, which asserts that CERT_ExtractPublicKey() returns a non-NULL value. When Libreswan runs in FIPS mode, a remote attacker can send a malformed X.509 certificate in a CERT payload to trigger the assertion, aborting the pluto daemon. Repeated exploitation produces sustained denial of service. Both IKEv1 and IKEv2 are affected. The CERT payload is processed before peer authentication, so no credentials are required.
Critical Impact
Unauthenticated remote attackers can crash the pluto daemon repeatedly, disrupting IPsec VPN availability on systems running Libreswan and the OS in FIPS mode with at least one CA certificate loaded.
Affected Products
- Libreswan (versions running in FIPS mode with CA certificates loaded in the NSS database)
- Deployments processing IKEv1 CERT payloads
- Deployments processing IKEv2 CERT payloads
Discovery Timeline
- 2026-09-02 - CVE-2026-14957 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-14957
Vulnerability Analysis
The vulnerability is an unchecked return value flaw ([CWE-252]) in Libreswan's certificate processing path. The add_decoded_cert() function invokes CERT_ExtractPublicKey() and passes the result to an assertion that expects a non-NULL pointer. Under FIPS mode, CERT_ExtractPublicKey() can legitimately return NULL when public key extraction fails, such as when an RSA exponent is set to 0. The failed assertion aborts the pluto IKE daemon.
Because the IKE CERT payload is parsed and decoded before peer authentication occurs, an attacker does not need valid credentials or a prior security association. Any host reachable on the IKE port (UDP 500 or 4500) can deliver the malformed certificate. The daemon restarts after each abort, but repeated malformed CERT payloads produce a persistent denial-of-service condition against IPsec VPN endpoints.
No memory corruption occurs and no remote code execution is possible. The impact is limited to availability.
Root Cause
The root cause is a missing NULL check on the return value of CERT_ExtractPublicKey(). The assertion assumed the extraction routine always succeeds when a certificate is decoded, but FIPS-mode NSS enforces stricter key validation and returns NULL for invalid keys such as those with an RSA exponent of 0. The assertion converts an error condition into an abort.
Attack Vector
An unauthenticated remote attacker sends an IKE message containing a CERT payload with a crafted X.509 certificate. The certificate contains an invalid RSA public key, for example one with an exponent of 0. When Libreswan decodes the certificate and attempts to extract the public key, NSS returns NULL, the assertion fires, and pluto aborts. Configurations using only PreSharedKey (PSK) authentication with no CA certificates loaded in the NSS database are not vulnerable. See the Libreswan CVE-2026-14957 Advisory for full technical details.
Detection Methods for CVE-2026-14957
Indicators of Compromise
- Repeated pluto daemon crashes or restart events in system logs, particularly assertion failures inside add_decoded_cert()
- IKE CERT payloads arriving from untrusted or unexpected source addresses on UDP 500 or 4500
- Systemd or init logs showing rapid service respawn of the Libreswan pluto process
Detection Strategies
- Monitor pluto process exit codes and correlate abort signals with inbound IKE traffic bursts
- Inspect IKE traffic for CERT payloads containing X.509 certificates with anomalous RSA public keys, including zero exponents
- Alert on Libreswan log entries referencing CERT_ExtractPublicKey failures or assertion aborts
Monitoring Recommendations
- Track availability metrics for IPsec tunnel establishment and IKE responder uptime
- Capture packet traces on IKE ports during suspected DoS events for offline certificate analysis
- Aggregate pluto daemon logs into a centralized SIEM to identify repeated crash patterns across VPN concentrators
How to Mitigate CVE-2026-14957
Immediate Actions Required
- Apply the Libreswan security update referenced in the vendor advisory as soon as it is available for your distribution
- Restrict inbound IKE traffic (UDP 500 and 4500) to known peer IP addresses using host or network firewalls
- Review whether FIPS mode is required; if not, evaluate disabling it as a temporary measure while patching
Patch Information
Refer to the Libreswan CVE-2026-14957 Advisory and the detailed advisory text for fixed versions and distribution-specific patches. The fix adds a NULL check on the return value of CERT_ExtractPublicKey() so that malformed certificates are rejected instead of triggering an assertion.
Workarounds
- Switch to PreSharedKey (PSK) authentication and remove all CA certificates from the NSS database if operational requirements permit, since PSK-only deployments without loaded CA certificates are not vulnerable
- Filter IKE traffic at perimeter firewalls to allow only authorized VPN peers, reducing exposure of the pluto daemon
- Deploy service watchdogs with rate limits on restart to detect and alert on repeated pluto crashes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
