diff --git a/libreswan-4.12-CVE-2026-14957.patch b/libreswan-4.12-CVE-2026-14957.patch
new file mode 100644
index 0000000..0bc7e24
--- /dev/null
+++ b/libreswan-4.12-CVE-2026-14957.patch
@@ -0,0 +1,76 @@
+From bb98559906f03b5d0eb5e598d36d6607f65dfa51 Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Thu, 9 Jul 2026 19:02:42 -0400
+Subject: [PATCH 1/2] x509: tighten nss_compat BER check
+
+---
+ lib/libswan/x509dn.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/libswan/x509dn.c b/lib/libswan/x509dn.c
+index 913b944b56..d01f794d7d 100644
+--- a/lib/libswan/x509dn.c
++++ b/lib/libswan/x509dn.c
+@@ -378,6 +378,7 @@ static err_t format_dn(struct jambuf *buf, asn1_t dn,
+ 		     * #BER.
+ 		     */
+ 		    (nss_compatible &&
++		     value_content.len > 0 &&
+ 		     ((const char*)value_content.ptr)[0] == '#')) {
+ 			/* BER */
+ 			jam(buf, "#");
+-- 
+2.54.0
+
+
+From 784a2d2bf54e38efdd2c6dd64835013c850ad1e0 Mon Sep 17 00:00:00 2001
+From: Andrew Cagney <cagney@gnu.org>
+Date: Thu, 9 Jul 2026 19:04:01 -0400
+Subject: [PATCH 2/2] ikev2: check the cert's pubkey unpacked before using it -
+ cve-2026-14957
+
+---
+ programs/pluto/nss_cert_verify.c | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
+index 3e16566fb1..43af788cb8 100644
+--- a/programs/pluto/nss_cert_verify.c
++++ b/programs/pluto/nss_cert_verify.c
+@@ -392,16 +392,23 @@ static void add_decoded_cert(CERTCertDBHandle *handle,
+ 	 */
+ 	if (libreswan_fipsmode()) {
+ 		SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
+-		passert(pk != NULL);
+-		unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
+-		if (pk->keyType == rsaKey && key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
+-			llog(RC_LOG, logger,
+-			     "FIPS: rejecting peer cert with key size %u under %u: %s",
+-			     key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
+-			     cert->subjectName);
+-			SECKEY_DestroyPublicKey(pk);
+-			CERT_DestroyCertificate(cert);
+-			return;
++		if (pk == NULL) {
++			llog_nss_error(RC_LOG, logger,
++				       "extracting certificate public key using CERT_ExtractPublicKey() failed");
++ 			return;
++ 		}
++
++		if (pk->keyType == rsaKey) {
++			unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
++			if (key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
++				llog(RC_LOG, logger,
++				     "FIPS: rejecting peer cert with key size %u under %u: %s",
++				     key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
++				     cert->subjectName);
++				SECKEY_DestroyPublicKey(pk);
++				CERT_DestroyCertificate(cert);
++				return;
++			}
+ 		}
+ 		SECKEY_DestroyPublicKey(pk);
+ 	}
+-- 
+2.54.0
+
diff --git a/libreswan.spec b/libreswan.spec
index 6c29132..d757782 100644
--- a/libreswan.spec
+++ b/libreswan.spec
@@ -37,7 +37,7 @@ Name: libreswan
 Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
 # version is generated in the release script
 Version: 4.12
-Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}.5
+Release: %{?prever:0.}2%{?prever:.%{prever}}%{?dist}.6
 License: GPLv2
 Url: https://libreswan.org/
 
@@ -58,6 +58,7 @@ Patch9: libreswan-4.12-ikev1-compute-keymat-default.patch
 Patch10: libreswan-4.12-CVE-2026-12413.patch
 Patch11: libreswan-4.12-CVE-2026-50721.patch
 Patch12: libreswan-4.12-CVE-2026-50722.patch
+Patch13: libreswan-4.12-CVE-2026-14957.patch
 
 BuildRequires: audit-libs-devel
 BuildRequires: bison
@@ -122,6 +123,7 @@ Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
 %patch10 -p1
 %patch11 -p1
 %patch12 -p1
+%patch13 -p1
 
 # linking to freebl is not needed
 sed -i "s/-lfreebl //" mk/config.mk
@@ -225,6 +227,9 @@ certutil -N -d sql:$tmpdir --empty-password
 %attr(0644,root,root) %doc %{_mandir}/*/*
 
 %changelog
+* Thu Jul 23 2026 Daiki Ueno  <dueno@redhat.com> - 4.12-2.6
+- Backport fix for CVE-2026-14957 (RHEL-212498)
+
 * Thu Jul 09 2026 Daiki Ueno  <dueno@redhat.com> - 4.12-2.5
 - Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722 (RHEL-190146, RHEL-190140, RHEL-190132)