CVE-2014-8104
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote...
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
Exploit likelihood
What each source reports
NVD Score used
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
- Record
CVE-2014-8104- CVSS 2.0
- 6.8 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
- Record
CVE-2014-8104- Updated
- 2026-11-02
EUVDEUVD-2014-7951 No score
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
- Record
EUVD-2014-7951- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p2qj-cw7j-f6wr No score
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote...
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
- Record
GHSA-p2qj-cw7j-f6wr- Updated
- 2026-11-02
OSV No score
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
- Record
CVE-2014-8104- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-8104 No score
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
- Record
DEBIAN-CVE-2014-8104- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0512 No score
Updated openvpn package fixes CVE-2014-8104
Updated openvpn packages fix security vulnerability:
Dragana Damjanovic discovered that OpenVPN incorrectly handled certain control channel packets. An authenticated attacker could use this issue to cause an OpenVPN server to crash, resulting in a denial of service (CVE-2014-8104).
- Record
MGASA-2014-0512- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10211-1 No score
openvpn-2.3.11-3.1 on GA media
These are all security issues fixed in the openvpn-2.3.11-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10211-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-8104 No score
OpenVPN 2.x before 2.0.11, 2.1.x, 2.2.x before 2.2.3, and 2.3.x before 2.3.6 allows remote authenticated users to cause a denial of service (server crash) via a small control channel packet.
- Record
UBUNTU-CVE-2014-8104- Updated
- 2026-11-02
OSVUSN-2430-1 No score
openvpn vulnerability
Dragana Damjanovic discovered that OpenVPN incorrectly handled certain control channel packets. An authenticated attacker could use this issue to cause an OpenVPN server to crash, resulting in a denial of service.
- Record
USN-2430-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openvpnDebian:12 |
before 2.3.4-5 | 2.3.4-5 |
openvpnDebian:13 |
before 2.3.4-5 | 2.3.4-5 |
openvpnDebian:14 |
before 2.3.4-5 | 2.3.4-5 |
openvpnDebian:6.0 |
before 2.1.3-2+squeeze3, plus listed versions 2.1.3-22.1.3-2+squeeze12.1.3-2+squeeze2 |
2.1.3-2+squeeze3 |
openvpnDebian:7 |
before 2.2.1-8+deb7u3, plus listed versions 2.2.1-82.2.1-8+deb7u12.2.1-8+deb7u2 |
2.2.1-8+deb7u3 |
openvpnMageia:4 |
before 2.3.2-3.1.mga4 | 2.3.2-3.1.mga4 |
openvpnUbuntu:14.04:LTS |
before 2.3.2-7ubuntu3.1, plus listed versions 2.3.2-4ubuntu12.3.2-5ubuntu12.3.2-7ubuntu12.3.2-7ubuntu22.3.2-7ubuntu3 |
2.3.2-7ubuntu3.1 |
openvpnopenSUSE:Tumbleweed |
before 2.3.11-3.1 | 2.3.11-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-8104 is a medium vulnerability (CVSS 6.8) in Openvpn, published December 1, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.48%, the 89th percentile. Fixed in openvpn 2.3.4-5.
References
mandriva.com/security/advisories?name=MDVSA-2015:139
advisories.mageia.org/MGASA-2014-0512.html
ubuntu.com/usn/USN-2430-1
debian.org/security/2014/dsa-3084
community.openvpn.net/openvpn/wiki/SecurityAnnouncement-97597e732b
lists.opensuse.org/opensuse-security-announce/2014-12/msg00008.html
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-8104
github.com/advisories/GHSA-p2qj-cw7j-f6wr
security-tracker.debian.org/tracker/CVE-2014-8104
bugs.mageia.org/show_bug.cgi?id=14714
ubuntu.com/security/CVE-2014-8104
cve.org/CVERecord?id=CVE-2014-8104
suse.com/security/cve/CVE-2014-8104