CVE-2023-46849
HIGHOpenVPN 2.6.0-2.6.6 - Denial of Service via Fragment Option
Title source: llmDescription
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.
References (5)
Core 5
Core References
Vendor Advisory
https://community.openvpn.net/openvpn/wiki/CVE-2023-46849
Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/
Vendor Advisory
https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/
Third Party Advisory
https://www.debian.org/security/2023/dsa-5555
Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/
Scores
CVSS v3
7.5
EPSS
0.0114
EPSS Percentile
62.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-369
Status
published
Products (6)
debian/debian_linux
12.0
fedoraproject/fedora
39
openvpn/openvpn
2.6.0 - 2.6.6
openvpn/openvpn_access_server
2.12.0
openvpn/openvpn_access_server
2.12.1
openvpn/openvpn_access_server
2.11.0 - 2.11.3
Published
Nov 11, 2023
Tracked Since
Feb 18, 2026