MGASA-2026-0236: openvpn Mageia
Vulnerability summary
MGASA-2026-0236 is a vulnerability in openvpn Mageia with no CVSS score yet.
Advisory lineage
Upstream 6 · Downstream 0Timeline
- 08-07-2026PublishedVulnerability first disclosed.
- 08-07-2026Last modifiedVulnerability information updated.
Description
Updated openvpn packages fix security vulnerabilities The updated packages fix security vulnerabilities: Possible 1-byte buffer overrun on NTLMv2 proxy responses. (CVE-2026-11771) Memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes. (CVE-2026-12932) Use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets. (CVE-2026-12996) Use-after-free bug in tls_wrap_reneg(), triggerable by suitable sequence of dynamic tls-crypt control-channel packets. (CVE-2026-13117) Server crash on reception of suitably malformed auth-token, if --auth-gen-token external-auth is active. (CVE-2026-13122) Another memory leak on reception of suitable tls-crypt-v2 packets that could lead to an out of memory situation and server crash. (CVE-2026-13698)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia2 products
- openvpn< 2.6.21-1.mga10
- openvpn< 2.6.21-1.mga9
1 vendor · 2 products
