Every CVE Search/ Get API key

CVE-2026-12932

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2...

7.1 HighFix available

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.42%Up 0.1 points since Jul 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.1

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Record
CVE-2026-12932
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-401
Updated
2026-11-02
EUVDEUVD-2026-51241 7.1

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Record
EUVD-2026-51241
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-93p4-5c7j-q5rx 7.1

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2...

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Record
GHSA-93p4-5c7j-q5rx
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-401
Updated
2026-11-02
NVD 7.1

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Record
CVE-2026-12932
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-401
Updated
2026-11-02
OSVALPINE-CVE-2026-12932 8.1

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Record
ALPINE-CVE-2026-12932
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSV 7.1

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Record
CVE-2026-12932
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-401
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2026-12932 8.1

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Record
DEBIAN-CVE-2026-12932
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2917 9.1

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2026-11771)

(CVE-2026-12932)

(CVE-2026-12996)

(CVE-2026-13117)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled(CVE-2026-13122)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

Record
OESA-2026-2917
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2918 9.1

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2026-11771)

(CVE-2026-12932)

(CVE-2026-12996)

(CVE-2026-13117)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled(CVE-2026-13122)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

Record
OESA-2026-2918
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3001 9.1

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2026-11771)

(CVE-2026-12932)

(CVE-2026-12996)

(CVE-2026-13117)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled(CVE-2026-13122)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

Record
OESA-2026-3001
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3929 9.1

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets (CVE-2026-12932)

Record
OESA-2026-3929
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-12932 7.1

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Record
UBUNTU-CVE-2026-12932
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVMGASA-2026-0236 No score

Updated openvpn packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Possible 1-byte buffer overrun on NTLMv2 proxy responses. (CVE-2026-11771) Memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes. (CVE-2026-12932) Use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets. (CVE-2026-12996) Use-after-free bug in tls_wrap_reneg(), triggerable by suitable sequence of dynamic tls-crypt control-channel packets. (CVE-2026-13117) Server crash on reception of suitably malformed auth-token, if --auth-gen-token external-auth is active. (CVE-2026-13122) Another memory leak on reception of suitable tls-crypt-v2 packets that could lead to an out of memory situation and server crash. (CVE-2026-13698)

Record
MGASA-2026-0236
Updated
2026-11-02
OSVopenSUSE-SU-2026:22072-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
openSUSE-SU-2026:22072-1
Updated
2026-11-02
OSVSUSE-SU-2026:24220-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
SUSE-SU-2026:24220-1
Updated
2026-11-02
OSVSUSE-SU-2026:3596-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
Record
SUSE-SU-2026:3596-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openvpn
Alpine:v3.24
 2.5.0 up to 2.7.5-r0
2.7.5-r0
openvpn
Debian:12
 before 2.6.14-0+deb12u2, plus listed versions
2.6.11-12.6.12-12.6.13-12.6.14-0+deb12u12.6.3-1
Show 10 moreShow less
2.6.3-1+deb12u12.6.3-1+deb12u1~bpo11+12.6.3-1+deb12u22.6.3-1+deb12u2~bpo11+12.6.3-1+deb12u32.6.3-1+deb12u42.6.3-22.6.3-2.12.6.7-12.6.9-1
2.6.14-0+deb12u2
openvpn
Debian:13
 before 2.6.14-1+deb13u3, plus listed versions
2.6.14-12.6.14-1+deb13u12.6.14-1+deb13u2
2.6.14-1+deb13u3
openvpn
Debian:14
 before 2.7.5-1, plus listed versions
2.6.14-12.6.14-22.6.15-12.7.0-12.7.0-1~bpo13+1
Show 19 moreShow less
2.7.0~alpha1-12.7.0~alpha2-12.7.0~alpha3-12.7.0~beta1-12.7.0~beta2-12.7.0~beta3-12.7.0~rc1-12.7.0~rc2-12.7.0~rc2-22.7.0~rc3-12.7.0~rc4-12.7.0~rc5-12.7.0~rc6-12.7.1-12.7.1-1~bpo13+12.7.2-12.7.2-1~bpo13+12.7.3-12.7.5-1~bpo13+1
2.7.5-1
openvpn
Mageia:10
From an advisory covering 6 CVEs
 before 2.6.21-1.mga10
2.6.21-1.mga10
openvpn
Mageia:9
From an advisory covering 6 CVEs
 before 2.6.21-1.mga9
2.6.21-1.mga9
openvpn
openEuler:24.03-LTS-SP3
From an advisory covering 6 CVEs
 before 2.6.9-8.oe2403sp3
2.6.9-8.oe2403sp3
openvpn
openEuler:24.03-LTS-SP1
From an advisory covering 6 CVEs
 before 2.6.9-8.oe2403sp1
2.6.9-8.oe2403sp1
openvpn
openEuler:24.03-LTS-SP4
From an advisory covering 6 CVEs
 before 2.6.9-8.oe2403sp4
2.6.9-8.oe2403sp4
openvpn
openEuler:22.03-LTS-SP4
 before 2.5.5-10.oe2203sp4
2.5.5-10.oe2203sp4
Show 17 moreShow less
Affected packages
PackageAffectedFixed
openvpn
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1
openvpn
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1
openvpn
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn-dco
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn-dco
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn-dco
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.3.2-4ubuntu12.3.2-5ubuntu12.3.2-7ubuntu12.3.2-7ubuntu22.3.2-7ubuntu3
Show 4 moreShow less
2.3.2-7ubuntu3.12.3.2-7ubuntu3.22.3.2-7ubuntu3.2+esm12.3.2-7ubuntu3.2+esm2
 None known
openvpn
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.3.7-1ubuntu12.3.7-2ubuntu12.3.8-1ubuntu12.3.10-1ubuntu12.3.10-1ubuntu2
Show 4 moreShow less
2.3.10-1ubuntu2.12.3.10-1ubuntu2.22.3.10-1ubuntu2.2+esm12.3.10-1ubuntu2.2+esm2
 None known
openvpn
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.3-4ubuntu12.4.4-1ubuntu12.4.4-2ubuntu12.4.4-2ubuntu1.12.4.4-2ubuntu1.2
Show 5 moreShow less
2.4.4-2ubuntu1.32.4.4-2ubuntu1.52.4.4-2ubuntu1.62.4.4-2ubuntu1.72.4.4-2ubuntu1.7+esm1
 None known
openvpn
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.4.7-1ubuntu22.4.7-1ubuntu2.20.04.22.4.7-1ubuntu2.20.04.32.4.7-1ubuntu2.20.04.42.4.12-0ubuntu0.20.04.12.4.12-0ubuntu0.20.04.2
 None known
openvpn
Ubuntu:22.04:LTS
 before 2.5.11-0ubuntu0.22.04.4, plus listed versions
2.5.1-3ubuntu12.5.1-3ubuntu22.5.1-3ubuntu42.5.1-3ubuntu52.5.5-1ubuntu1
Show 6 moreShow less
2.5.5-1ubuntu32.5.5-1ubuntu3.12.5.9-0ubuntu0.22.04.22.5.9-0ubuntu0.22.04.32.5.11-0ubuntu0.22.04.12.5.11-0ubuntu0.22.04.3
2.5.11-0ubuntu0.22.04.4
openvpn
Ubuntu:24.04:LTS
 before 2.6.19-0ubuntu0.24.04.3, plus listed versions
2.6.5-0ubuntu12.6.7-1ubuntu12.6.9-1ubuntu22.6.9-1ubuntu32.6.9-1ubuntu4
Show 8 moreShow less
2.6.9-1ubuntu4.12.6.12-0ubuntu0.24.04.12.6.12-0ubuntu0.24.04.32.6.14-0ubuntu0.24.04.12.6.14-0ubuntu0.24.04.22.6.14-0ubuntu0.24.04.32.6.19-0ubuntu0.24.04.12.6.19-0ubuntu0.24.04.2
2.6.19-0ubuntu0.24.04.3
openvpn
Ubuntu:25.10
 All versions, plus listed versions
2.6.13-1ubuntu32.6.14-1ubuntu12.6.14-2ubuntu12.6.14-2ubuntu1.12.6.19-0ubuntu0.25.10.12.6.19-0ubuntu0.25.10.2
 None known
openvpn
Ubuntu:26.04:LTS
 before 2.7.0-1ubuntu1.2, plus listed versions
2.6.14-2ubuntu12.6.15-1ubuntu12.7.0~rc5-1ubuntu52.7.0~rc6-1ubuntu12.7.0-1ubuntu12.7.0-1ubuntu1.1
2.7.0-1ubuntu1.2
openvpn
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-12932 is a high vulnerability (CVSS 7.1) in Openvpn, published July 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in openvpn 2.7.5-r0.

References

Show 38 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open