CVE-2026-13698

openvpn: From CVEorg collector

Published Jul 6, 2026 CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Description

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Analysis

Technical impact

The flaw is a memory leak triggered when OpenVPN processes TLS‑Crypt‑V2 client keys. The leak causes the server to gradually exhaust heap memory, eventually making the VPN service unresponsive or terminating it. This manifests as a denial of service for all VPN users, and the weakness is recognized as a classic heap usage error (CWE‑401) combined with a lack of resource limits (CWE‑770).

Affected Systems

OpenVPN releases 2.5.0 through 2.5.11, 2.6.0 through 2.6.20, and 2.7_alpha1 through 2.7.4 that enable TLS‑Crypt‑V2 client authentication are affected. Deployments using these versions with TLS‑Crypt‑V2 are at risk, while other OpenVPN products or older releases are not listed.

Risk and Exploitability

The CVSS score of 6.0 indicates medium severity, and the EPSS of < 1% reflects a low exploitation probability. Exploitation requires possession of a valid TLS‑Crypt‑V2 client key, meaning the attacker must first authenticate or compromise a client key. Once authenticated, repeated connection attempts can trigger the leak, leading to a gradual denial of service over time.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OpenVPN

unaffected

Version	Status	Constraints
`2.5.0`	affected	≤ 2.5.11
`2.6.0`	affected	≤ 2.6.20
`2.7_alpha1`	affected	≤ 2.7.4

Configuration 1 [-]

OR	cpe:2.3:a:openvpn:openvpn:::::community:::*
	cpe:2.3:a:openvpn:openvpn:::::community:::*
	cpe:2.3:a:openvpn:openvpn:::::community:::*

No data.

Vendor Product Versions

Openvpn

Version	Status	Scheme	Platform
`[2.5.0,2.5.11]`	affected	semver	—
`[2.6.0,2.6.20]`	affected	semver	—
`[2.7_alpha1,2.7.4]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a patched OpenVPN release that eliminates the memory‑leak.
If an upgrade is not immediately possible, disable TLS‑Crypt‑V2 client authentication or rotate the keys to reduce exposure.
Set up monitoring to detect abnormal memory consumption and automatically restart the OpenVPN service when thresholds are exceeded.

Generated by OpenCVE AI on August 1, 2026 at 18:33 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4666-1	openvpn security update
Debian DSA	DSA-6376-1	openvpn security update
Ubuntu USN	USN-8540-1	OpenVPN vulnerabilities

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.549% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://community.openvpn.net/Security%20Announcements/CVE-2026-13698
https://nvd.nist.gov/vuln/detail/CVE-2026-13698
https://www.cve.org/CVERecord?id=CVE-2026-13698

History

Jul 9, 2026 12:15 AM Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title	Memory Leak in OpenVPN TLS‑Crypt‑V2 Client Key Processing Leading to Potential Denial of Service	openvpn: From CVEorg collector
References		https://nvd.nist.gov/vuln/detail/CVE-2026-13698 https://www.cve.org/CVERecord?id=CVE-2026-13698
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jul 8, 2026 10:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Memory Leak in OpenVPN TLS‑Crypt‑V2 Client Key Processing Leading to Potential Denial of Service

Jul 8, 2026 6:00 AM Title updated View changes

Type	Values Removed	Values Added
Title	Memory Leak Causing Remote Denial of Service in OpenVPN

Jul 7, 2026 6:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Memory Leak Causing Remote Denial of Service in OpenVPN

Jul 6, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 6, 2026 4:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Openvpn Openvpn openvpn
Vendors & Products		Openvpn Openvpn openvpn

Jul 6, 2026 2:30 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service
Weaknesses		CWE-401 CWE-770
References		https://community.openvpn.net/Security%20Announcements/CVE-2026-13698
Metrics		cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`