Filtered by vendor Openvpn
Subscribe
Total
79 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-35058 | 1 Openvpn | 1 Openvpn | 2026-08-11 | N/A | 6.5 MEDIUM |
| Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet. | |||||
| CVE-2026-40215 | 1 Openvpn | 1 Openvpn | 2026-08-11 | N/A | 7.4 HIGH |
| A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion. | |||||
| CVE-2026-11604 | 1 Openvpn | 1 Openvpn | 2026-08-11 | N/A | 6.5 MEDIUM |
| An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service). | |||||
| CVE-2026-11771 | 1 Openvpn | 1 Openvpn | 2026-08-05 | N/A | 7.5 HIGH |
| OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server | |||||
| CVE-2026-12932 | 1 Openvpn | 1 Openvpn | 2026-08-05 | N/A | 8.1 HIGH |
| A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets | |||||
| CVE-2026-12996 | 2 Debian, Openvpn | 2 Debian Linux, Openvpn | 2026-08-05 | N/A | 8.1 HIGH |
| A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry | |||||
| CVE-2026-13117 | 1 Openvpn | 1 Openvpn | 2026-08-05 | N/A | 8.1 HIGH |
| An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage | |||||
| CVE-2026-13379 | 1 Openvpn | 1 Openvpn | 2026-08-05 | N/A | 9.1 CRITICAL |
| The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process | |||||
| CVE-2026-9560 | 1 Openvpn | 1 Connect | 2026-07-23 | N/A | 7.8 HIGH |
| Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel | |||||
| CVE-2025-3110 | 1 Openvpn | 1 Openvpn Access Server | 2026-07-10 | N/A | 7.5 HIGH |
| OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy | |||||
| CVE-2026-13122 | 1 Openvpn | 1 Openvpn | 2026-07-09 | N/A | 5.3 MEDIUM |
| OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled | |||||
| CVE-2026-13698 | 1 Openvpn | 1 Openvpn | 2026-07-09 | N/A | 7.5 HIGH |
| A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service | |||||
| CVE-2023-46850 | 3 Debian, Fedoraproject, Openvpn | 4 Debian Linux, Fedora, Openvpn and 1 more | 2026-06-23 | N/A | 9.8 CRITICAL |
| Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer. | |||||
| CVE-2025-50054 | 1 Openvpn | 1 Ovpn-dco-win | 2026-06-17 | N/A | 5.5 MEDIUM |
| Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to the kernel driver resulting in a system crash | |||||
| CVE-2025-3908 | 2 Linux, Openvpn | 2 Linux Kernel, Openvpn3linux | 2026-06-17 | N/A | 6.2 MEDIUM |
| The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory. | |||||
| CVE-2025-2704 | 1 Openvpn | 1 Openvpn | 2026-06-17 | N/A | 7.5 HIGH |
| OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase | |||||
| CVE-2025-13751 | 2 Microsoft, Openvpn | 2 Windows, Openvpn | 2026-06-17 | N/A | 5.5 MEDIUM |
| Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service. | |||||
| CVE-2025-13086 | 1 Openvpn | 1 Openvpn | 2026-06-17 | N/A | 7.5 HIGH |
| Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client | |||||
| CVE-2025-12106 | 1 Openvpn | 1 Openvpn | 2026-06-17 | N/A | 9.1 CRITICAL |
| Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses | |||||
| CVE-2024-8474 | 1 Openvpn | 1 Connect | 2026-06-17 | N/A | 7.5 HIGH |
| OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic | |||||