CVE-2026-13379

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. This issue is fixed in 2.3.15 and 2.4.2.

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses.

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, allowing an attacker to load an arbitrary plug-in that can interact with the privileged OpenVPN interactive service.

In OpenVPN 2.6.9 and earlier, the interactive service allows the OpenVPN service pipe to be accessed remotely. This allows a remote attacker to interact with the privileged OpenVPN interactive service.

OpenVPN versions 2.6.0 to 2.6.6 contain a use after free vulnerability that may lead to undefined behavior, leaking memory buffers, or remote code execution when sending network buffers to a remote peer.

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.

Incomplete fix for CVE-2026-12996. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options.