CVE-2026-14957

Libreswan's add_decoded_cert() function, when running in FIPS mode, calls CERT_ExtractPublicKey() and asserts the result is non-NULL, but that function can legitimately return NULL (for example, when an RSA public key has an exponent of 0), causing an unchecked-value/reachable-assertion defect (CWE-252/CWE-617). A remote, unauthenticated attacker can trigger it by sending a malformed X.509 certificate inside a CERT payload during an IKEv1 or IKEv2 handshake; because the CERT payload is processed before peer authentication, no credentials are required. The assertion causes the pluto daemon to abort and restart, and repeated exploitation results in a denial of service; remote code execution is not possible. Only deployments where both the OS and libreswan run in FIPS mode and at least one CA certificate is loaded in the NSS database are vulnerable, while configurations using only PreSharedKey authentication with no CA certificates loaded are not affected. No public proof-of-concept, KEV listing, or known exploitation exists; EPSS estimates a 0.6% chance of exploitation in the next 30 days.

What to do: Upgrade libreswan to the release that fixes CVE-2026-14957 as soon as your distribution publishes it, prioritizing FIPS-mode deployments that load CA certificates into the NSS database. As interim mitigations, disable FIPS mode if compliance does not require it, remove loaded CA certificates or restrict IKEv1/IKEv2 exposure to trusted networks, and check whether libreswan and the OS are running in FIPS mode before assessing impact.