Openvpn vulnerabilities, page 4
98 vulnerabilities
Known vulnerabilities in Openvpn products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 18 products.
CVE-2024-27459openvpnopenvpn+1
EPSS score8.26%
The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.CVE-2024-27903openvpnopenvpn+1EPSS score8.92%
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.CVE-2024-5594alpineopenvpn+21EPSS score0.82%
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.CVE-2024-5198openvpnopenvpn-gui+2EPSS score0.14%
OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt.CVE-2024-24974openvpnopenvpn+1EPSS score9.76%
The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged OpenVPN interactive service.CVE-2024-28882alpineopenvpn+8EPSS score0.66%
OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing sessionCVE-2024-8474openvpnconnect+1EPSS score0.53%
OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN trafficCVE-2026-63649ubuntuopenvpn+1EPSS score0.33%
The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checksCVE-2026-63650debianopenvpn+2EPSS score0.36%
OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup fieldCVE-2026-40215alpineopenvpn+3EPSS score0.59%
A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.CVE-2026-2738openvpnovpn-dco-winEPSS score0.15%
Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packetCVE-2026-13698alpineopenvpn+3EPSS score0.55%
A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of serviceCVE-2026-13117alpineopenvpn+3EPSS score0.64%
An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakageCVE-2026-13122alpineopenvpn+3EPSS score0.46%
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabledCVE-2026-13379ubuntuopenvpn+1EPSS score0.59%
The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection processCVE-2026-84226ubuntuopenvpn+1EPSS score0.14%
OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration stepsCVE-2026-84732alpineopenvpn+5EPSS score0.54%
Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflowCVE-2026-84256ubuntuopenvpn+1EPSS score0.38%
An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subjectCVE-2026-11771alpineopenvpn+3EPSS score0.68%
OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy serverCVE-2026-11604openvpnovpn-dco-winEPSS score0.34%
An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).