Vulnerabilidades de OpenVPN

CVE-2026-84471 Alta · 7.2 CWE-416 14/10/2026

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2...

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.

CVE-2026-88964 Alta · 7.1 CWE-125 13/10/2026

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows...

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options

CVE-2026-105390 Média · 6.9 CWE-413 13/10/2026

Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and...

Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.

CVE-2026-84790 Alta · 7.6 CWE-158 13/10/2026

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others…

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

CVE-2026-84256 Alta · 7.7 CWE-78 07/09/2026

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on...

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject

CVE-2026-12996 Alta · 8.1 CWE-125 30/07/2026

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote...

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

CVE-2026-11604 Média · 6.5 CWE-122 10/06/2026

Heap-based Buffer Overflow em OpenVPN Ovpn-dco-win

An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).

CVE-2026-40215 Alta · 7.4 CWE-125 08/06/2026

Out-of-bounds Read em Openvpn

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

CVE-2026-35058 Média · 6.5 CWE-617 08/06/2026

Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0…

Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.

CVE-2026-9560 Alta · 7.8 CWE-78 26/05/2026

OS Command Injection em OpenVPN Connect

Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel

CVE-2026-2738 Média · 5.6 CWE-131 19/02/2026

Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system…

Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet

CVE-2025-15497 Baixa · 3.8 CWE-617 30/01/2026

Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows…

Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service

CVE-2025-13086 Alta · 7.5 CWE-940 03/12/2025

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and…

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

CVE-2025-13751 Média · 5.5 CWE-770 03/12/2025

Allocation of Resources Without Limits or Throttling em Openvpn

Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.

CVE-2025-12106 Crítica · 9.1 CWE-126 01/12/2025

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an…

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

CVE-2025-50055 Média · 6.4 CWE-79 27/10/2025

Cross-site Scripting (XSS) em OpenVPN Access Server

Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter

CVE-2025-10680 Alta · 8.8 CWE-78 24/10/2025

OS Command Injection em Openvpn

OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use