CVE-2026-12996

OpenVPN: OpenVPN: Denial of Service or memory leak via crafted packets

Published Jul 30, 2026 CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Description

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

Analysis

Technical impact

A use‑after‑free flaw exists in OpenVPN versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. An authenticated peer can send specially crafted packets during TLS session promotion or expiry to potentially trigger a crash, resulting in denial of service, or cause memory leakage. The weakness is a use‑after‑free (CWE‑416) combined with a memory‑access violation (CWE‑125).

Affected Systems

The vulnerability affects the OpenVPN software produced by OpenVPN Systems. It is present in all releases from 2.6.0 to 2.6.20 and from 2.7_alpha1 to 2.7.4, regardless of platform, as long as TLS session promotion or expiry is enabled.

Risk and Exploitability

The CVSS score of 6 indicates a moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog, suggesting no publicly known exploits. The attack vector requires an attacker to be an authenticated peer, possessing valid client credentials, and to transmit crafted packets during TLS session promotion or expiry to trigger the flaw.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenVPN

unaffected

Version	Status	Constraints
`2.6.0`	affected	≤ 2.6.20
`2.7_alpha1`	affected	≤ 2.7.4

Configuration 1 [-]

OR	cpe:2.3:a:openvpn:openvpn::::::::
	cpe:2.3:a:openvpn:openvpn::::::::
	cpe:2.3:o:debian:debian_linux:11.0:::::::*

No data.

Vendor Product Versions

Openvpn

Version	Status	Scheme	Platform
`[2.6.0,2.6.20]`	affected	semver	—
`[2.7_alpha1,2.7.4]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade OpenVPN to the latest patched release (2.6.21 or newer, or 2.7.5 or newer) and deploy the updated binaries across all servers.
Configure the server to accept authentication only from trusted users and enforce stringent client‑certificate checks to shrink the potential attacker set.
Enable detailed logging of TLS session promotion and expiry events, and implement anomaly detection or alerting for unusual packet patterns that could indicate an attempted exploitation.

Generated by OpenCVE AI on August 2, 2026 at 05:08 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4666-1	openvpn security update
Debian DLA	DLA-4653-2	openvpn regression update
Debian DSA	DSA-6376-1	openvpn security update
Ubuntu USN	USN-8540-1	OpenVPN vulnerabilities

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.461% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026
https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026
https://community.openvpn.net/Security%20Announcements/CVE-2026-12996
https://lists.debian.org/debian-lts-announce/2026/07/msg00013.html
https://nvd.nist.gov/vuln/detail/CVE-2026-12996
https://www.cve.org/CVERecord?id=CVE-2026-12996

History

Aug 1, 2026 12:15 AM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		OpenVPN: OpenVPN: Denial of Service or memory leak via crafted packets
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-12996 https://www.cve.org/CVERecord?id=CVE-2026-12996
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}` threat_severity `Moderate`

Jul 31, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 30, 2026 6:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openvpn Openvpn openvpn
Vendors & Products		Openvpn Openvpn openvpn

Jul 30, 2026 5:00 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry
Weaknesses		CWE-125 CWE-416
References		https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026 https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026 https://community.openvpn.net/Security%20Announcements/CVE-2026-12996
Metrics		cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}`