The vulnerability is an improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN versions 2.6.0–2.6.19 and 2.7_alpha1–2.7.1. An attacker who can send specially crafted packets can trigger a fatal assertion, causing the OpenVPN process to terminate and resulting in a denial of service. The flaw is a bounds-check failure (CWE-617) involving input validation, and it does not directly compromise confidentiality or integrity.

Affected installations include OpenVPN software by OpenVPN Inc. The vulnerable versions are OpenVPN 2.6.0 through 2.6.19 and the alpha releases 2.7_alpha1 through 2.7.1. All deployments that use tls-crypt-v2 for key exchange in these releases are susceptible.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation. Attackers must be authenticated to the VPN service and capable of sending a crafted packet, so the threat requires legitimate credentials or compromised client software. Because the impact is a loss of service, it can affect availability for users and disrupt network connectivity, especially in environments where the OpenVPN server is a critical component.