OpenVPN vulnerabilities
Published CVEs affecting OpenVPN products: 24 record(s), with severity, exploitation and fixes.
CVE-2026-84471
High · 7.2
CWE-416 Oct 14, 2026
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2...
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
CVE-2026-88964
High · 7.1
CWE-125 Oct 13, 2026
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows...
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
CVE-2026-105390
Medium · 6.9
CWE-413 Oct 13, 2026
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and...
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.
CVE-2026-84790
High · 7.6
CWE-158 Oct 13, 2026
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others…
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field
CVE-2026-84256
High · 7.7
CWE-78 Sep 7, 2026
An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on...
An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject
CVE-2026-13379
Critical · 9.1
CWE-125 Jul 30, 2026
Out-of-bounds Read in Openvpn
The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process
CVE-2026-13117
High · 8.1
CWE-416 Jul 30, 2026
Use After Free in Openvpn
An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage
CVE-2026-12996
High · 8.1
CWE-125 Jul 30, 2026
A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote...
A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry
CVE-2026-12932
High · 8.1
CWE-401 Jul 30, 2026
Missing Release of Memory after Effective Lifetime in Openvpn
A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets
CVE-2026-11771
High · 7.5
CWE-121 Jul 30, 2026
Stack-based Buffer Overflow in Openvpn
OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server
CVE-2025-3110
High · 7.5
CWE-444 Jul 8, 2026
HTTP Request Smuggling in OpenVPN Access Server
OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy
CVE-2026-13122
Medium · 5.3
CWE-617 Jul 6, 2026
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote…
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
CVE-2026-13698
High · 7.5
CWE-401 Jul 6, 2026
Missing Release of Memory after Effective Lifetime in Openvpn
A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service
CVE-2026-11604
Medium · 6.5
CWE-122 Jun 10, 2026
Heap-based Buffer Overflow in OpenVPN Ovpn-dco-win
An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).
CVE-2026-40215
High · 7.4
CWE-125 Jun 8, 2026
Out-of-bounds Read in Openvpn
A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.
CVE-2026-35058
Medium · 6.5
CWE-617 Jun 8, 2026
Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0…
Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.
CVE-2026-9560
High · 7.8
CWE-78 May 26, 2026
OS Command Injection in OpenVPN Connect
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel
CVE-2026-2738
Medium · 5.6
CWE-131 Feb 19, 2026
Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system…
Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet
CVE-2025-15497
Low · 3.8
CWE-617 Jan 30, 2026
Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows…
Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service
CVE-2025-13086
High · 7.5
CWE-940 Dec 3, 2025
Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and…
Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client
CVE-2025-13751
Medium · 5.5
CWE-770 Dec 3, 2025
Allocation of Resources Without Limits or Throttling in Openvpn
Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.
CVE-2025-12106
Critical · 9.1
CWE-126 Dec 1, 2025
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an…
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses
CVE-2025-50055
Medium · 6.4
CWE-79 Oct 27, 2025
Cross-site Scripting (XSS) in OpenVPN Access Server
Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter
CVE-2025-10680
High · 8.8
CWE-78 Oct 24, 2025
OS Command Injection in Openvpn
OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use