Openvpn Access Server vulnerabilities

4 vulnerabilities

Known vulnerabilities in Openvpn Access Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2025-3110openvpnaccess server+1
EPSS score
0.45%
OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy6.4CVE-2025-50055openvpnaccess server
EPSS score
0.21%
Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter7.5CVE-2023-46849alpineopenvpn+8
EPSS score
1.15%
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.9.8CVE-2023-46850alpineopenvpn+8
EPSS score
2.00%
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.