AZL-98441 CVE-2026-14957 affecting package libreswan for versions less than 4.15-3

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

EUVD-2026-69820

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-14957 FIPS mode assertion failure via malicious CERT payload

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-14957 FIPS mode assertion failure via malicious CERT payload

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-14957

CVE-2026-14957 is a denial-of-service vulnerability in Libreswan (an IPsec/IKE implementation for Linux). In FIPS mode , the add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts the result is non-NULL. When public key extraction fails (e.g., RSA exponent set to 0), the assertion ...

CVE-2026-14957: Reachable Assertion

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

UBUNTU-CVE-2026-52131

llama.cpp b5693 and before has a Reachable Assertion via the ggufreader::read function...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for August 2026.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 26.0.0-IF002 and 24.0.1-IF009. These vulnerabilities have been also addressed in 24.0.0-IF008 and 25.0.0-IF006 Vulnerability Details CVEID:CVE-2026-11806 DESCRIPTION: IBM WebSphere Application Server - Liberty...

CVE-2026-80606

A flaw was found in the Linux kernel's drm/xe/userptr component. When a specific test configuration is enabled, the system attempts to perform a write operation while holding a read-only lock. This incorrect lock handling leads to an assertion failure, which can cause system instability or a deni...

librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload

A flaw was found in Libreswan's implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS 1 v1.5 RSA encryption, the RSAauthenticatehashsignaturerawrsa function fails to properly validate the length of the authentication hash. A remote,...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...

librenswan: IKEv2 Denial of Service via malformed fragmentation

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

librenswan: IKEv2 Denial of Service via malformed fragmentation

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

librenswan: IKEv2 Denial of Service via RSA-SHA1 (PKCS#1 RSASSA-PKCS1-v1_5) authentication payload

A flaw was found in Libreswan's implementation of IKEv2 authentication when processing signatures utilizing the RSASSA-PKCS1-v15 scheme. The RSAauthenticatehashsignaturepkcs115rsa function does not correctly validate the DER encoding of the ASN.1 digest. A remote, unauthenticated attacker could...

librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload

A flaw was found in Libreswan's implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS 1 v1.5 RSA encryption, the RSAauthenticatehashsignaturerawrsa function fails to properly validate the length of the authentication hash. A remote,...

libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...

RHEL 9 : libreswan (RHSA-2026:61779)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61779 advisory. Libreswan is an implementation of IPsec and IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide...

CVE-2026-82590

A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...

CVE-2026-80606

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifierlock for write on inject test path When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit runs vmacheckuserptr with the svm notifierlock taken for read. The test injection causes vmacheckuserpt...

UBUNTU-CVE-2026-80606

In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifierlock for write on inject test path When CONFIGDRMXEUSERPTRINVALINJECT=y, xeptsvmuserptrprecommit runs vmacheckuserptr with the svm notifierlock taken for read. The test injection causes vmacheckuserpt...