OpenVPN Vulnerabilities and Affected Products
Vulnerabilities associated with OpenVPN.
Products
Clear product- OpenVPN20 vulnerabilities
- Access Server4 vulnerabilities
- OpenVPN Connect3 vulnerabilities
- ovpn-dco-win3 vulnerabilities
- OpenVPN 22 vulnerabilities
- OpenVPN 2 (Community)2 vulnerabilities
- OpenVPN-GUI2 vulnerabilities
- openvpn_gui2 vulnerabilities
- connect1 vulnerability
- Easy-RSA1 vulnerability
- OpenVPN 3 Core Library1 vulnerability
- OpenVPN 3 Linux1 vulnerability
- OpenVPN GUI1 vulnerability
- openvpn21 vulnerability
- ovpn-dco1 vulnerability
- tap-windows61 vulnerability
- tap_windows61 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-12932HIGH | Generated title:OpenVPN tls-crypt-v2 Client Key Extraction Memory Leak Denial of ServiceA memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets CWE-401Jul 30, 2026 | CVSS7.1v4.0 | EPSS0.417% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-12996MEDIUM | Generated title:OpenVPN Use-After-Free VulnerabilityA use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry | CVSS6.0v4.0 | EPSS0.461% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-11771HIGH | Generated title:OpenVPN NTLM Proxy Authentication Off-by-One Buffer Write VulnerabilityOpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server | CVSS7.0v4.0 | EPSS0.375% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-13117MEDIUM | Generated title:OpenVPN Use-After-Free in TLS Session PromotionAn incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage CWE-416Jul 30, 2026 | CVSS6.0v4.0 | EPSS0.398% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-13379MEDIUM | Generated title:OpenVPN Windows Interactive Service DNS State Pollution and Denial of ServiceThe Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process | CVSS5.1v4.0 | EPSS0.338% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-13122MEDIUM | Generated title:OpenVPN Reachable Assertion Denial of Service via Malformed Authentication TokenOpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled CWE-617Jul 6, 2026 | CVSS5.9v4.0 | EPSS0.294% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-13698MEDIUM | Generated title:OpenVPN Memory Leak Denial of ServiceA memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service | CVSS6.0v4.0 | EPSS0.314% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-40215MEDIUM | Generated title:OpenVPN Use-After-Free in TLS Session PromotionA race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion. | CVSS6.1v4.0 | EPSS0.386% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-35058MEDIUM | Generated title:OpenVPN tls-crypt-v2 Reachable Assertion Denial of ServiceImproper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet. CWE-617Jun 8, 2026 | CVSS6.9v4.0 | EPSS0.392% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Generated title:OpenVPN Reachable Assertion Denial of ServiceInsufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service CWE-617Jan 30, 2026 | CVSS3.8v4.0 | EPSS0.323% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-13086MEDIUM | Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client CWE-940Dec 3, 2025 | CVSS4.6v4.0 | EPSS0.627% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service. | CVSS1.3v4.0 | EPSS0.167% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2025-12106CRITICAL | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses CWE-126Dec 1, 2025 | CVSS9.1v3.1 | EPSS0.543% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-10680HIGH | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use CWE-78Oct 24, 2025 | CVSS8.8v3.1 | EPSS7.09% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-4877HIGH | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges CWE-268Apr 3, 2025 | CVSS8.8v3.1 | EPSS0.423% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-2704HIGH | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase CWE-754Apr 2, 2025 | CVSS7.5v3.1 | EPSS0.815% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-5594CRITICAL | OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs. CWE-1287Jan 6, 2025 | CVSS9.1v3.1 | EPSS0.835% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-28882MEDIUM | OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session CWE-772Jul 8, 2024 | CVSS4.3v3.1 | EPSS0.665% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-24974HIGH | The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service. CWE-923Jul 8, 2024 | CVSS7.5v3.1 | EPSS9.76% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-7235HIGH | The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables. CWE-276Feb 21, 2024 | CVSS8.4v3.1 | EPSS0.214% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |