Every CVE Search/ Get API key

CVE-2026-13698

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1...

6.0 MediumFix available

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.55%Unchanged since Jul 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.0

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Record
CVE-2026-13698
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-401, CWE-770
Updated
2026-11-02
EUVDEUVD-2026-41877 6.0

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Record
EUVD-2026-41877
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-rwhm-c36w-484h 6.0

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1...

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Record
GHSA-rwhm-c36w-484h
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-401
Updated
2026-11-02
NVD 6.0

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Record
CVE-2026-13698
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-401, CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2026-13698 7.5

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Record
ALPINE-CVE-2026-13698
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 6.0

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Record
CVE-2026-13698
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-401, CWE-770
Updated
2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2026-13698 7.5

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Record
DEBIAN-CVE-2026-13698
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2917 9.1

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2026-11771)

(CVE-2026-12932)

(CVE-2026-12996)

(CVE-2026-13117)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled(CVE-2026-13122)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

Record
OESA-2026-2917
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2918 9.1

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2026-11771)

(CVE-2026-12932)

(CVE-2026-12996)

(CVE-2026-13117)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled(CVE-2026-13122)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

Record
OESA-2026-2918
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3001 9.1

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2026-11771)

(CVE-2026-12932)

(CVE-2026-12996)

(CVE-2026-13117)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled(CVE-2026-13122)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

Record
OESA-2026-3001
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3784 9.1

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry(CVE-2026-12996)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

Record
OESA-2026-3784
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-13698 6.0

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

Record
UBUNTU-CVE-2026-13698
CVSS 4.0
6.0 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2026-0236 No score

Updated openvpn packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Possible 1-byte buffer overrun on NTLMv2 proxy responses. (CVE-2026-11771) Memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes. (CVE-2026-12932) Use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets. (CVE-2026-12996) Use-after-free bug in tls_wrap_reneg(), triggerable by suitable sequence of dynamic tls-crypt control-channel packets. (CVE-2026-13117) Server crash on reception of suitably malformed auth-token, if --auth-gen-token external-auth is active. (CVE-2026-13122) Another memory leak on reception of suitable tls-crypt-v2 packets that could lead to an out of memory situation and server crash. (CVE-2026-13698)

Record
MGASA-2026-0236
Updated
2026-11-02
OSVopenSUSE-SU-2026:21488-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-13122: denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled (bsc#1270413).
  • CVE-2026-13698: denial of service via memory leak triggered by remote attackers with a valid tls-crypt-v2 client key (bsc#1270414).
Record
openSUSE-SU-2026:21488-1
Updated
2026-11-02
OSVSUSE-SU-2026:3407-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-13122: denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled (bsc#1270413).
  • CVE-2026-13698: denial of service via memory leak triggered by remote attackers with a valid tls-crypt-v2 client key (bsc#1270414).
Record
SUSE-SU-2026:3407-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openvpn
Alpine:v3.24
 2.5.0 up to 2.7.5-r0
2.7.5-r0
openvpn
Debian:12
 before 2.6.14-0+deb12u2, plus listed versions
2.6.11-12.6.12-12.6.13-12.6.14-0+deb12u12.6.3-1
Show 10 moreShow less
2.6.3-1+deb12u12.6.3-1+deb12u1~bpo11+12.6.3-1+deb12u22.6.3-1+deb12u2~bpo11+12.6.3-1+deb12u32.6.3-1+deb12u42.6.3-22.6.3-2.12.6.7-12.6.9-1
2.6.14-0+deb12u2
openvpn
Debian:13
 before 2.6.14-1+deb13u3, plus listed versions
2.6.14-12.6.14-1+deb13u12.6.14-1+deb13u2
2.6.14-1+deb13u3
openvpn
Debian:14
 before 2.7.5-1, plus listed versions
2.6.14-12.6.14-22.6.15-12.7.0-12.7.0-1~bpo13+1
Show 19 moreShow less
2.7.0~alpha1-12.7.0~alpha2-12.7.0~alpha3-12.7.0~beta1-12.7.0~beta2-12.7.0~beta3-12.7.0~rc1-12.7.0~rc2-12.7.0~rc2-22.7.0~rc3-12.7.0~rc4-12.7.0~rc5-12.7.0~rc6-12.7.1-12.7.1-1~bpo13+12.7.2-12.7.2-1~bpo13+12.7.3-12.7.5-1~bpo13+1
2.7.5-1
openvpn
Mageia:10
From an advisory covering 6 CVEs
 before 2.6.21-1.mga10
2.6.21-1.mga10
openvpn
Mageia:9
From an advisory covering 6 CVEs
 before 2.6.21-1.mga9
2.6.21-1.mga9
openvpn
openEuler:24.03-LTS-SP3
From an advisory covering 6 CVEs
 before 2.6.9-8.oe2403sp3
2.6.9-8.oe2403sp3
openvpn
openEuler:24.03-LTS-SP1
From an advisory covering 6 CVEs
 before 2.6.9-8.oe2403sp1
2.6.9-8.oe2403sp1
openvpn
openEuler:24.03-LTS-SP4
From an advisory covering 6 CVEs
 before 2.6.9-8.oe2403sp4
2.6.9-8.oe2403sp4
openvpn
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.5.5-10.oe2203sp4
2.5.5-10.oe2203sp4
Show 15 moreShow less
Affected packages
PackageAffectedFixed
openvpn
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.23.1
2.6.10-150600.3.23.1
openvpn-dco
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.23.1
2.6.10-150600.3.23.1
openvpn
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.23.1
2.6.10-150600.3.23.1
openvpn-dco
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.23.1
2.6.10-150600.3.23.1
openvpn
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.23.1
2.6.10-150600.3.23.1
openvpn-dco
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 2 CVEs
 before 2.6.10-150600.3.23.1
2.6.10-150600.3.23.1
openvpn
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.3.2-4ubuntu12.3.2-5ubuntu12.3.2-7ubuntu12.3.2-7ubuntu22.3.2-7ubuntu3
Show 4 moreShow less
2.3.2-7ubuntu3.12.3.2-7ubuntu3.22.3.2-7ubuntu3.2+esm12.3.2-7ubuntu3.2+esm2
 None known
openvpn
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.3.7-1ubuntu12.3.7-2ubuntu12.3.8-1ubuntu12.3.10-1ubuntu12.3.10-1ubuntu2
Show 4 moreShow less
2.3.10-1ubuntu2.12.3.10-1ubuntu2.22.3.10-1ubuntu2.2+esm12.3.10-1ubuntu2.2+esm2
 None known
openvpn
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.3-4ubuntu12.4.4-1ubuntu12.4.4-2ubuntu12.4.4-2ubuntu1.12.4.4-2ubuntu1.2
Show 5 moreShow less
2.4.4-2ubuntu1.32.4.4-2ubuntu1.52.4.4-2ubuntu1.62.4.4-2ubuntu1.72.4.4-2ubuntu1.7+esm1
 None known
openvpn
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.4.7-1ubuntu22.4.7-1ubuntu2.20.04.22.4.7-1ubuntu2.20.04.32.4.7-1ubuntu2.20.04.42.4.12-0ubuntu0.20.04.12.4.12-0ubuntu0.20.04.2
 None known
openvpn
Ubuntu:22.04:LTS
 before 2.5.11-0ubuntu0.22.04.4, plus listed versions
2.5.1-3ubuntu12.5.1-3ubuntu22.5.1-3ubuntu42.5.1-3ubuntu52.5.5-1ubuntu1
Show 6 moreShow less
2.5.5-1ubuntu32.5.5-1ubuntu3.12.5.9-0ubuntu0.22.04.22.5.9-0ubuntu0.22.04.32.5.11-0ubuntu0.22.04.12.5.11-0ubuntu0.22.04.3
2.5.11-0ubuntu0.22.04.4
openvpn
Ubuntu:24.04:LTS
 before 2.6.19-0ubuntu0.24.04.3, plus listed versions
2.6.5-0ubuntu12.6.7-1ubuntu12.6.9-1ubuntu22.6.9-1ubuntu32.6.9-1ubuntu4
Show 8 moreShow less
2.6.9-1ubuntu4.12.6.12-0ubuntu0.24.04.12.6.12-0ubuntu0.24.04.32.6.14-0ubuntu0.24.04.12.6.14-0ubuntu0.24.04.22.6.14-0ubuntu0.24.04.32.6.19-0ubuntu0.24.04.12.6.19-0ubuntu0.24.04.2
2.6.19-0ubuntu0.24.04.3
openvpn
Ubuntu:25.10
 All versions, plus listed versions
2.6.13-1ubuntu32.6.14-1ubuntu12.6.14-2ubuntu12.6.14-2ubuntu1.12.6.19-0ubuntu0.25.10.12.6.19-0ubuntu0.25.10.2
 None known
openvpn
Ubuntu:26.04:LTS
 before 2.7.0-1ubuntu1.2, plus listed versions
2.6.14-2ubuntu12.6.15-1ubuntu12.7.0~rc5-1ubuntu52.7.0~rc6-1ubuntu12.7.0-1ubuntu12.7.0-1ubuntu1.1
2.7.0-1ubuntu1.2
openvpn
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 2.6.10-160000.4.1
2.6.10-160000.4.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-13698 is a medium vulnerability (CVSS 6.0) in Openvpn, published July 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in openvpn 2.7.5-r0.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open