Openvpn
55 CVEs across 19 Openvpn products. Browse Openvpn vulnerabilities, severities, and proof-of-concept exploits.
Openvpn products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63650 | | 2026-08-14 | OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup… | |
CVE-2026-63649 | | 2026-08-14 | The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configurati… | |
CVE-2026-13379 | Critical | 9.1 | 2026-07-30 | The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a cr… |
CVE-2026-13117 | High | 8.1 | 2026-07-30 | An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS sessi… |
CVE-2026-12996 | High | 8.1 | 2026-07-30 | A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or lea… |
CVE-2026-12932 | High | 8.1 | 2026-07-30 | A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial… |
CVE-2026-11771 | High | 7.5 | 2026-07-30 | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potential… |
CVE-2025-3110 | High | 7.5 | 2026-07-08 | OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggli… |
CVE-2026-13122 | Medium | 5.3 | 2026-07-06 | OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token tha… |
CVE-2026-13698 | High | 7.5 | 2026-07-06 | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 clie… |
CVE-2026-11604 | Medium | 6.5 | 2026-06-10 | An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigg… |
CVE-2026-40215 | High | 7.4 | 2026-06-08 | A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory v… |
CVE-2026-35058 | Medium | 6.5 | 2026-06-08 | Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attac… |
CVE-2026-9560 | High | 7.8 | 2026-05-26 | Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privil… |
CVE-2026-2738 | | 2026-02-19 | Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag… | |
CVE-2025-15497 | | 2026-01-30 | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of se… | |
CVE-2025-13086 | High | 7.5 | 2025-12-03 | Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a d… |
CVE-2025-13751 | Medium | 5.5 | 2025-12-03 | Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the… |
CVE-2025-12106 | Critical | 9.1 | 2025-12-01 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses |
CVE-2025-50055 | Medium | 6.4 | 2025-10-27 | Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML… |
CVE-2025-10680 | High | 8.8 | 2025-10-24 | OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown… |
CVE-2025-50054 | Medium | 5.5 | 2025-06-20 | Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message… |
CVE-2025-3908 | Medium | 6.2 | 2025-05-19 | The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory wh… |
CVE-2024-4877 | High | 8.8 | 2025-04-03 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would conn… |
CVE-2025-2704 | High | 7.5 | 2025-04-02 | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying netwo… |
CVE-2024-13454 | Medium | 5.3 | 2025-01-20 | Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenS… |
CVE-2024-5198 | Low | 3.3 | 2025-01-15 | OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NU… |
CVE-2024-8474 | High | 7.5 | 2025-01-06 | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthoriz… |
CVE-2024-5594 | Critical | 9.1 | 2025-01-06 | OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending… |
CVE-2024-28882 | Medium | 4.3 | 2024-07-08 | OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing s… |
CVE-2024-1305 | Critical | 9.8 | 2024-07-08 | tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory… |
CVE-2024-27903 | Critical | 9.8 | 2024-07-08 | OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can… |
CVE-2024-27459 | High | 7.8 | 2024-07-08 | The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with… |
CVE-2024-24974 | High | 7.5 | 2024-07-08 | The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with t… |
CVE-2023-6247 | Medium | 6.5 | 2024-02-29 | The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the application crashing. |
CVE-2023-7235 | High | 8.4 | 2024-02-21 | The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using… |
CVE-2023-7245 | High | 7.8 | 2024-02-20 | The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary c… |
CVE-2023-7224 | High | 7.8 | 2024-01-08 | OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environ… |
CVE-2023-46850 | Critical | 9.8 | 2023-11-11 | Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a r… |
CVE-2023-46849 | High | 7.5 | 2023-11-11 | Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could… |
CVE-2022-3761 | Medium | 5.9 | 2023-10-17 | OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuratio… |
CVE-2020-20813 | High | 7.5 | 2023-08-22 | Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet. |
CVE-2021-4234 | High | 7.5 | 2022-07-06 | OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the clie… |
CVE-2022-33738 | High | 7.5 | 2022-07-06 | OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal |
CVE-2022-33737 | High | 7.5 | 2022-07-06 | The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin… |
CVE-2022-0547 | Critical | 9.8 | 2022-03-18 | OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred auth… |
CVE-2021-3824 | Medium | 6.1 | 2021-09-23 | OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL. |
CVE-2021-3547 | High | 7.4 | 2021-07-12 | OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certif… |
CVE-2021-3613 | High | 7.8 | 2021-07-02 | OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows… |
CVE-2021-3606 | High | 7.8 | 2021-07-02 | OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which all… |
CVE-2020-36382 | High | 7.5 | 2021-06-04 | OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data… |
CVE-2020-15077 | Medium | 5.3 | 2021-06-04 | OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with… |
CVE-2020-15076 | High | 7.8 | 2021-05-26 | Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp. |
CVE-2020-15078 | High | 7.5 | 2021-04-26 | OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authe… |
CVE-2020-15075 | High | 7.1 | 2021-03-30 | OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmp. |
CVE-2020-15074 | High | 7.5 | 2020-07-14 | OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making… |
CVE-2020-11462 | High | 7.5 | 2020-05-04 | An issue was discovered in OpenVPN Access Server before 2.7.0 and 2.8.x before 2.8.3. With the full featured RPC2 interface enabled, it is possible to achieve… |
CVE-2020-11810 | Low | 3.7 | 2020-04-27 | An issue was discovered in OpenVPN 2.4.x before 2.4.9. An attacker can inject a data channel v2 (P_DATA_V2) packet using a victim's peer-id. Normally such pack… |
CVE-2020-9442 | High | 7.8 | 2020-02-28 | OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privi… |
CVE-2020-8953 | Critical | 9.8 | 2020-02-13 | OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). |
CVE-2018-9336 | High | 7.8 | 2018-05-01 | openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malfor… |
CVE-2018-7544 | Critical | 9.1 | 2018-03-16 | A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a passwor… |
CVE-2017-12166 | Critical | 9.8 | 2017-10-04 | OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code ex… |
CVE-2017-7522 | Medium | 6.5 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded… |
CVE-2017-7521 | Medium | 5.9 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issu… |
CVE-2017-7520 | High | 7.4 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attack… |
CVE-2017-7508 | High | 7.5 | 2017-06-27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet. |
CVE-2017-5868 | Medium | 6.1 | 2017-05-26 | CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbitrary HTTP headers and consequently cond… |
CVE-2017-7479 | Medium | 6.5 | 2017-05-15 | OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of ser… |
CVE-2017-7478 | High | 7.5 | 2017-05-15 | OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed… |
CVE-2016-6329 | Medium | 5.9 | 2017-01-31 | OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypte… |
CVE-2014-8104 | | 2014-12-03 | OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via… | |
CVE-2014-9104 | | 2014-11-26 | Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Server 1.5.6 and earlier allow remote att… | |
CVE-2014-5455 | Medium | 5.3 | 2014-08-25 | Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allo… |
CVE-2013-2692 | | 2014-05-13 | Cross-site request forgery (CSRF) vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authenti… | |
CVE-2013-2061 | | 2013-11-18 | The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a… | |
CVE-2008-3459 | | 2008-08-04 | Unspecified vulnerability in OpenVPN 2.1-beta14 through 2.1-rc8, when running on non-Windows systems, allows remote servers to execute arbitrary commands via c… | |
CVE-2006-2229 | | 2006-05-05 | OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the m… | |
CVE-2006-1629 | | 2006-04-06 | OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable. | |
CVE-2005-3409 | | 2005-11-02 | OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function ca… | |
CVE-2005-3393 | | 2005-11-01 | Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string spe… | |
CVE-2005-2534 | | 2005-08-24 | Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not enabled, allows remote attackers to cause a denial of service (server crash) via simultaneou… | |
CVE-2005-2533 | | 2005-08-24 | OpenVPN before 2.0.1, when running in "dev tap" Ethernet bridging mode, allows remote authenticated clients to cause a denial of service (memory exhaustion) vi… | |
CVE-2005-2532 | | 2005-08-24 | OpenVPN before 2.0.1 does not properly flush the OpenSSL error queue when a packet can not be decrypted by the server, which allows remote authenticated attack… | |
CVE-2005-2531 | | 2005-08-24 | OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificat… |