The flaw is a race condition in OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 that can be triggered during TLS session promotion. It leads to a use‑after‑free vulnerability that may cause a server crash or leak heap memory. The primary impact is a denial of service, with the possibility of memory disclosure exposing sensitive information.

The affected software is the OpenVPN server component, bundled as the OpenVPN application. All releases from 2.6.0 up to and including 2.6.19, and from 2.7_alpha1 through 2.7.1 contain this unpatched race condition. Any system running these versions in a networked environment is potentially vulnerable until the product is updated.

The CVSS score of 6.1 places the issue in the medium severity band, while the EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is remote, as the exploit requires an attacker to send crafted traffic that forces TLS session promotion while the race condition is active. Addressing the flaw by applying a vendor‑issued patch is the recommended remediation.