CVE-2026-35058
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1, improper validation of packet length during tls-crypt-v2 key extraction allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.
Risk Assessment
An authenticated attacker can crash the OpenVPN server, disrupting VPN service.
Recommendation
Update OpenVPN to version 2.6.20 or later (or 2.7.2) which includes the fix.
Other vulnerabilities in OpenVPN
See all- CVE-2017-7520High
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.
- CVE-2017-7508High
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.
- CVE-2017-7478High
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. This issue is fixed in 2.3.15 and 2.4.2.
- CVE-2026-13379Critical
The Windows interactive service in OpenVPN (versions 2.7_alpha1 through 2.7.4) allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during disconnection.
- CVE-2025-12106Critical
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses.
- CVE-2023-46850Critical
OpenVPN versions 2.6.0 to 2.6.6 contain a use after free vulnerability that may lead to undefined behavior, leaking memory buffers, or remote code execution when sending network buffers to a remote peer.
- CVE-2017-12166Critical
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
- CVE-2026-63650Low
OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field.
- CVE-2026-63649Medium
The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks.
- CVE-2026-13117High
In OpenVPN (versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4), an incomplete guard allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to denial of service or memory leakage.
Original NVD description (English source)
Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.