Openvpn vulnerabilities
98 vulnerabilities
Known vulnerabilities in Openvpn products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 18 products.
Products
18- Openvpn65 vulnerabilities
- Openvpn Access Server21 vulnerabilities
- Connect8 vulnerabilities
- Ovpn Dco Win6 vulnerabilities
- Access Server4 vulnerabilities
- Openvpn Connect3 vulnerabilities
- Openvpn 22 vulnerabilities
- Openvpn 2 (Community)2 vulnerabilities
- Openvpn Gui2 vulnerabilities
- Openvpn GUI2 vulnerabilities
- Easy Rsa1 vulnerabilities
- Openvpn 31 vulnerabilities
- Openvpn 3 Core Library1 vulnerabilities
- Openvpn 3 Linux1 vulnerabilities
- Openvpn3Linux1 vulnerabilities
- Ovpn Dco1 vulnerabilities
- Private Tunnel1 vulnerabilities
- Tap Windows61 vulnerabilities
CVE-2026-105390openvpnovpn-dco-win
EPSS score0.11%
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.CVE-2026-88964debianopenvpn+2EPSS score0.47%
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search optionsCVE-2026-84790debianopenvpn+2EPSS score0.22%
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject fieldCVE-2026-84471debianopenvpn+2EPSS score0.41%
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.CVE-2018-9336alpineopenvpn+4EPSS score0.59%
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.CVE-2018-7544debianopenvpn+3EPSS score1.79%
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a "signal SIGTERM" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warningCVE-2013-2692openvpnopenvpn_access_serverEPSS score0.97%
Cross-site request forgery (CSRF) vulnerability in the Admin web interface in OpenVPN Access Server before 1.8.5 allows remote attackers to hijack the authentication of administrators for requests that create administrative users.CVE-2013-2061debianopenvpn+3EPSS score2.81%
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.CVE-2021-4234openvpnopenvpn_access_serverEPSS score0.89%
OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the client again does not respond to, resulting in a limited amplification attack.CVE-2021-3824openvpnopenvpn_access_serverEPSS score0.75%
OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.CVE-2021-3613openvpnconnectEPSS score0.74%
OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (OpenVPNConnect.exe).CVE-2021-3606openvpnopenvpnEPSS score0.34%
OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process (openvpn.exe).CVE-2021-3547openvpnopenvpnEPSS score1.24%
OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration.CVE-2016-6329debianopenvpn+3EPSS score5.94%
OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.CVE-2025-2704alpineopenvpn+10EPSS score0.83%
OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phaseCVE-2025-13751alpineopenvpn+13EPSS score0.17%
Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.CVE-2025-13086alpineopenvpn+14EPSS score0.64%
Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating clientCVE-2025-10680ubuntuopenvpn+1EPSS score7.34%
OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in useCVE-2025-15497debianopenvpn+1EPSS score0.36%
Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of serviceCVE-2025-12106openvpnopenvpnEPSS score0.56%
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses