CVE-2025-3110

HighCVSS 7.5

Published: 08/07/2026(UTC)Updated: 29/09/2026(UTC)Translated: 11/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

36th percentile - higher than 36% of all known CVEs

Summary

OpenVPN Access Server versions 2.7.2 through 3.1.0 accept bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy.

Risk Assessment

An attacker can exploit this vulnerability to manipulate HTTP requests, potentially bypassing reverse proxy security controls, leading to unauthorized access or data interception.

Recommendation

Immediately upgrade OpenVPN Access Server to version 3.1.1 or later, which includes a fix that rejects bare line-feed sequences in HTTP headers.

Other vulnerabilities in OpenVPN Access Server

CVE-2025-50055Medium
Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter.

Original NVD description (English source)

OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy

Vulnerability data from NVD (NIST) · CISA KEV · EPSS