CVE-2026-13122

MediumCVSS 5.3

Published: 06/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

37th percentile - higher than 37% of all known CVEs

Summary

A vulnerability in OpenVPN versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows a remote attacker to cause a denial of service by sending a malformed authentication token when external-auth is enabled. The issue is due to a reachable assertion in the code.

Risk Assessment

An attacker can remotely crash the OpenVPN server, disrupting VPN service and potentially causing network access loss for all users.

Recommendation

Immediately upgrade OpenVPN to version 2.6.21 or later, which includes the fix. If upgrading is not possible, temporarily disable the external-auth option.

Original NVD description (English source)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled