diff --git a/SPECS/libreswan/CVE-2026-14957.patch b/SPECS/libreswan/CVE-2026-14957.patch
new file mode 100644
index 00000000000..f18a57ca5d3
--- /dev/null
+++ b/SPECS/libreswan/CVE-2026-14957.patch
@@ -0,0 +1,65 @@
+From b3564ae0257672d89ee5a4f6d1b9048710bf91d5 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Fri, 4 Sep 2026 06:51:37 +0000
+Subject: [PATCH] Backport FIPS cert public key null check and DN hash guard
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://libreswan.org/security/CVE-2026-14957/CVE-2026-14957.patch
+---
+ lib/libswan/x509dn.c             |  1 +
+ programs/pluto/nss_cert_verify.c | 25 ++++++++++++++++---------
+ 2 files changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/lib/libswan/x509dn.c b/lib/libswan/x509dn.c
+index b07e38b..626e6e4 100644
+--- a/lib/libswan/x509dn.c
++++ b/lib/libswan/x509dn.c
+@@ -378,6 +378,7 @@ static err_t format_dn(struct jambuf *buf, asn1_t dn,
+ 		     * #BER.
+ 		     */
+ 		    (nss_compatible &&
++		     value_content.len > 0 &&
+ 		     ((const char*)value_content.ptr)[0] == '#')) {
+ 			/* BER */
+ 			jam(buf, "#");
+diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
+index 3e16566..81a6493 100644
+--- a/programs/pluto/nss_cert_verify.c
++++ b/programs/pluto/nss_cert_verify.c
+@@ -392,17 +392,24 @@ static void add_decoded_cert(CERTCertDBHandle *handle,
+ 	 */
+ 	if (libreswan_fipsmode()) {
+ 		SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
+-		passert(pk != NULL);
+-		unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
+-		if (pk->keyType == rsaKey && key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
+-			llog(RC_LOG, logger,
+-			     "FIPS: rejecting peer cert with key size %u under %u: %s",
+-			     key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
+-			     cert->subjectName);
+-			SECKEY_DestroyPublicKey(pk);
+-			CERT_DestroyCertificate(cert);
++		if (pk == NULL) {
++			llog_nss_error(RC_LOG, logger,
++				       "extracting certificate public key using CERT_ExtractPublicKey() failed");
+ 			return;
+ 		}
++
++		if (pk->keyType == rsaKey) {
++			unsigned key_bit_size = pk->u.rsa.modulus.len * BITS_PER_BYTE;
++			if (key_bit_size < FIPS_MIN_RSA_KEY_SIZE) {
++				llog(RC_LOG, logger,
++				     "FIPS: rejecting peer cert with key size %u under %u: %s",
++				     key_bit_size, FIPS_MIN_RSA_KEY_SIZE,
++				     cert->subjectName);
++				SECKEY_DestroyPublicKey(pk);
++				CERT_DestroyCertificate(cert);
++				return;
++			}
++		}
+ 		SECKEY_DestroyPublicKey(pk);
+ 	}
+ 
+-- 
+2.45.4
+
diff --git a/SPECS/libreswan/libreswan.spec b/SPECS/libreswan/libreswan.spec
index 24d51d1859f..d3fdae163e9 100644
--- a/SPECS/libreswan/libreswan.spec
+++ b/SPECS/libreswan/libreswan.spec
@@ -27,7 +27,7 @@
 Summary:        Internet Key Exchange (IKEv1 and IKEv2) implementation for IPsec
 Name:           libreswan
 Version:        4.15
-Release:        2%{?dist}
+Release:        3%{?dist}
 License:        GPLv2+
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -40,6 +40,7 @@ Source5:        https://download.libreswan.org/cavs/ikev2.fax.bz2
 Patch0:         CVE-2026-12413.patch
 Patch1:         CVE-2026-50721.patch
 Patch2:         CVE-2026-50722.patch
+Patch3:         CVE-2026-14957.patch
 
 BuildRequires: audit-libs-devel
 BuildRequires: bison
@@ -197,6 +198,9 @@ certutil -N -d sql:$tmpdir --empty-password
 %doc %{_mandir}/*/*
 
 %changelog
+* Fri Sep 04 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4.15-3
+- Patch for CVE-2026-14957
+
 * Fri Jul 03 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 4.15-2
 - Patch for CVE-2026-50722, CVE-2026-50721, CVE-2026-12413