PatchTheCVElibreswan vulnerabilities and fixes
Recent CVEs affecting libreswan, with upgrade or downgrade steps. 3 tracked.
libreswan has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-07-02. Highest priority: CVE-2026-12413 (score 43/100).
- CVE-2026-12413 HIGH 7.5 UPGRADE An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart
- CVE-2026-50721 HIGH 8.1 UPGRADE Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify the length of
- CVE-2026-50722 HIGH 8.1 UPGRADE Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly verify the DER
FAQ
How do I fix libreswan vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is libreswan being exploited right now?
None of the tracked libreswan CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which libreswan CVE should I patch first?
CVE-2026-12413 currently ranks highest (43/100): An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart.