Rocky Linux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1785496521)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785496521 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

AlmaLinux 9.6 [TuxCare] Security Update: libreswan (ALMALINUX9.6:CLSA-2026:1785496521)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1785496521 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

AlmaLinux 9.2 [TuxCare] Security Update: libreswan (ALMALINUX9.2:CLSA-2026:1785422092)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785422092 advisory. - In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However,...

MGASA-2026-0456 Updated libreswan package fixes a security vulnerability

FIPS mode assertion failure via malicious CERT payload. CVE-2026-14957...

Updated libreswan package fixes a security vulnerability

FIPS mode assertion failure via malicious CERT payload. CVE-2026-14957...

FIPS mode assertion failure via malicious CERT payload

...

CVE-2026-14957

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-14957 FIPS mode assertion failure via malicious CERT payload

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-14957

CVE-2026-14957 is a denial-of-service vulnerability in Libreswan (an IPsec/IKE implementation for Linux). In FIPS mode , the add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts the result is non-NULL. When public key extraction fails (e.g., RSA exponent set to 0), the assertion ...

CVE-2026-14957 FIPS mode assertion failure via malicious CERT payload

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...

CVE-2026-14957

In FIPS mode, Libreswan's adddecodedcert function calls CERTExtractPublicKey and asserts that the result is not NULL. However, CERTExtractPublicKey returns NULL when public key extraction fails, for example if the RSA exponent is set to 0. A remote attacker can send a malformed X.509 certificate ...