Description
An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage
Published: 2026-07-30
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use‑after‑free during TLS session promotion, potentially leading to a denial of service or memory leakage. The weakness corresponds to CWE-416.

Affected Systems

The vulnerability affects OpenVPN deployments running the affected versions: 2.6.0‑2.6.20 and 2.7_alpha1‑2.7.4. Any host or service using these OpenVPN builds is potentially exposed.

Risk and Exploitability

With a CVSS score of 6, the flaw presents a medium severity risk. The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate as a peer; however, once authenticated they can cause interruptive service failure or initiate memory disclosure in the OpenVPN process.

Generated by OpenCVE AI on August 3, 2026 at 10:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenVPN to version 2.6.21 or later, or to 2.7.5 or newer, which contain the patch for the guard error
  • If an upgrade is delayed, disable TLS session promotion features or enforce strict peer authentication to reduce risk
  • Monitor OpenVPN logs for session establishment anomalies and block suspicious peers until a secure version is deployed

Generated by OpenCVE AI on August 3, 2026 at 10:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4666-1 openvpn security update
Debian DSA Debian DSA DSA-6376-1 openvpn security update
Ubuntu USN Ubuntu USN USN-8540-1 OpenVPN vulnerabilities
History

Sat, 01 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Title OpenVPN: OpenVPN: Denial of service or memory leakage via incomplete TLS guard
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H'}

threat_severity

Moderate

Thu, 30 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Openvpn
Openvpn openvpn
Vendors & Products Openvpn
Openvpn openvpn

Thu, 30 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Description An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage
Weaknesses CWE-416
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Openvpn Openvpn
cve-icon MITRE

Status: PUBLISHED

Assigner: OpenVPN

Published:

Updated: 2026-07-30T18:08:24.623Z

Reserved: 2026-06-23T21:02:48.228Z

Link: CVE-2026-13117

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T17:16:28.580

Modified: 2026-08-05T19:37:47.617

Link: CVE-2026-13117

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-30T16:32:42Z

Links: CVE-2026-13117 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T10:45:03Z

Weaknesses