Every CVE Search/ Get API key

CVE-2026-40215

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote...

6.1 MediumFix available

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

0.37%Up 0.2 points since Jun 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.1

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Record
CVE-2026-40215
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L
Weakness
CWE-125, CWE-416
Updated
2026-11-02
EUVDEUVD-2026-35200 6.1

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Record
EUVD-2026-35200
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-3mmv-h5fc-pvwj 6.1

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote...

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Record
GHSA-3mmv-h5fc-pvwj
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 6.1

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Record
CVE-2026-40215
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125, CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2026-40215 7.4

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Record
ALPINE-CVE-2026-40215
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSV 6.1

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Record
CVE-2026-40215
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L
Weakness
CWE-125, CWE-416
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2026-40215 7.4

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Record
DEBIAN-CVE-2026-40215
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2623 6.9

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.(CVE-2026-35058)

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.(CVE-2026-40215)

Record
OESA-2026-2623
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2624 6.9

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.(CVE-2026-35058)

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.(CVE-2026-40215)

Record
OESA-2026-2624
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2625 6.1

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.(CVE-2026-40215)

Record
OESA-2026-2625
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2626 6.9

openvpn security update

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.(CVE-2026-35058)

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.(CVE-2026-40215)

Record
OESA-2026-2626
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVUBUNTU-CVE-2026-40215 6.1

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Record
UBUNTU-CVE-2026-40215
CVSS 4.0
6.1 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1786495354 No score

Fix CVE(s): CVE-2026-12996

  • SECURITY UPDATE: Use-after-free of a pending dedicated ACK buffer when a TLS session is freed during session promotion or expiry
    • debian/patches/CVE-2026-12996.patch: add the check_session_buf_not_used() safeguard, including its ks->ack_write_buf check, and call it before every site in tls_multi_process() that frees or resets a session
    • CVE-2026-12996
    • the safeguard does not exist in 2.4.7, so it is introduced here already in its post-CVE-2026-12996 form; as a result this patch also fixes CVE-2026-40215, which shares the same safeguard
Record
CLSA-2026-1786495354
Updated
2026-11-02
OSVMGASA-2026-0126 No score

Updated openvpn packages fix security vulnerabilities

CVE-2026-35058 - fix server ASSERT() on receiving a suitably malformed packet with a valid tls-crypt-v2 key CVE-2026-40215 - fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances

Record
MGASA-2026-0126
Updated
2026-11-02
OSVopenSUSE-SU-2026:22072-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
openSUSE-SU-2026:22072-1
Updated
2026-11-02
OSVSUSE-SU-2026:24220-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
SUSE-SU-2026:24220-1
Updated
2026-11-02
OSVSUSE-SU-2026:3596-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
Record
SUSE-SU-2026:3596-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openvpn
Alpine:v3.20
 2.6.0 up to 2.6.20-r0
2.6.20-r0
openvpn
Alpine:v3.21
 2.6.0 up to 2.6.20-r0
2.6.20-r0
openvpn
Alpine:v3.22
 2.6.0 up to 2.6.20-r0
2.6.20-r0
openvpn
Alpine:v3.23
 2.6.0 up to 2.6.20-r0
2.6.20-r0
openvpn
Alpine:v3.24
 2.6.0 up to 2.6.20-r0
2.6.20-r0
openvpn
TuxCare:Debian:10
From an advisory covering 2 CVEs
 before 2.4.7-1+deb10u1+tuxcare.els2
2.4.7-1+deb10u1+tuxcare.els2
openvpn
Debian:12
 before 2.6.14-0+deb12u1, plus listed versions
2.6.11-12.6.12-12.6.13-12.6.3-12.6.3-1+deb12u1
Show 9 moreShow less
2.6.3-1+deb12u1~bpo11+12.6.3-1+deb12u22.6.3-1+deb12u2~bpo11+12.6.3-1+deb12u32.6.3-1+deb12u42.6.3-22.6.3-2.12.6.7-12.6.9-1
2.6.14-0+deb12u1
openvpn
Debian:13
 before 2.6.14-1+deb13u2, plus listed versions
2.6.14-12.6.14-1+deb13u1
2.6.14-1+deb13u2
openvpn
Debian:14
 before 2.7.2-1, plus listed versions
2.6.14-12.6.14-22.6.15-12.7.0-12.7.0-1~bpo13+1
Show 16 moreShow less
2.7.0~alpha1-12.7.0~alpha2-12.7.0~alpha3-12.7.0~beta1-12.7.0~beta2-12.7.0~beta3-12.7.0~rc1-12.7.0~rc2-12.7.0~rc2-22.7.0~rc3-12.7.0~rc4-12.7.0~rc5-12.7.0~rc6-12.7.1-12.7.1-1~bpo13+12.7.2-1~bpo13+1
2.7.2-1
openvpn
Mageia:9
From an advisory covering 2 CVEs
 before 2.6.20-1.1.mga9
2.6.20-1.1.mga9
Show 21 moreShow less
Affected packages
PackageAffectedFixed
openvpn
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.6.9-7.oe2403sp1
2.6.9-7.oe2403sp1
openvpn
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 2.6.9-7.oe2403sp3
2.6.9-7.oe2403sp3
openvpn
openEuler:20.03-LTS-SP4
 before 2.4.8-12.oe2003sp4
2.4.8-12.oe2003sp4
openvpn
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 2.5.5-7.oe2203sp4
2.5.5-7.oe2203sp4
openvpn
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1
openvpn
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1
openvpn
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn-dco
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn-dco
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn-dco
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.3.2-4ubuntu12.3.2-5ubuntu12.3.2-7ubuntu12.3.2-7ubuntu22.3.2-7ubuntu3
Show 4 moreShow less
2.3.2-7ubuntu3.12.3.2-7ubuntu3.22.3.2-7ubuntu3.2+esm12.3.2-7ubuntu3.2+esm2
 None known
openvpn
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.3.7-1ubuntu12.3.7-2ubuntu12.3.8-1ubuntu12.3.10-1ubuntu12.3.10-1ubuntu2
Show 4 moreShow less
2.3.10-1ubuntu2.12.3.10-1ubuntu2.22.3.10-1ubuntu2.2+esm12.3.10-1ubuntu2.2+esm2
 None known
openvpn
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.3-4ubuntu12.4.4-1ubuntu12.4.4-2ubuntu12.4.4-2ubuntu1.12.4.4-2ubuntu1.2
Show 5 moreShow less
2.4.4-2ubuntu1.32.4.4-2ubuntu1.52.4.4-2ubuntu1.62.4.4-2ubuntu1.72.4.4-2ubuntu1.7+esm1
 None known
openvpn
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.4.7-1ubuntu22.4.7-1ubuntu2.20.04.22.4.7-1ubuntu2.20.04.32.4.7-1ubuntu2.20.04.42.4.12-0ubuntu0.20.04.12.4.12-0ubuntu0.20.04.2
 None known
openvpn
Ubuntu:22.04:LTS
 before 2.5.11-0ubuntu0.22.04.3, plus listed versions
2.5.1-3ubuntu12.5.1-3ubuntu22.5.1-3ubuntu42.5.1-3ubuntu52.5.5-1ubuntu1
Show 5 moreShow less
2.5.5-1ubuntu32.5.5-1ubuntu3.12.5.9-0ubuntu0.22.04.22.5.9-0ubuntu0.22.04.32.5.11-0ubuntu0.22.04.1
2.5.11-0ubuntu0.22.04.3
openvpn
Ubuntu:24.04:LTS
 before 2.6.19-0ubuntu0.24.04.2, plus listed versions
2.6.5-0ubuntu12.6.7-1ubuntu12.6.9-1ubuntu22.6.9-1ubuntu32.6.9-1ubuntu4
Show 7 moreShow less
2.6.9-1ubuntu4.12.6.12-0ubuntu0.24.04.12.6.12-0ubuntu0.24.04.32.6.14-0ubuntu0.24.04.12.6.14-0ubuntu0.24.04.22.6.14-0ubuntu0.24.04.32.6.19-0ubuntu0.24.04.1
2.6.19-0ubuntu0.24.04.2
openvpn
Ubuntu:25.10
 before 2.6.19-0ubuntu0.25.10.2, plus listed versions
2.6.13-1ubuntu32.6.14-1ubuntu12.6.14-2ubuntu12.6.14-2ubuntu1.12.6.19-0ubuntu0.25.10.1
2.6.19-0ubuntu0.25.10.2
openvpn
Ubuntu:26.04:LTS
 before 2.7.0-1ubuntu1.1, plus listed versions
2.6.14-2ubuntu12.6.15-1ubuntu12.7.0~rc5-1ubuntu52.7.0~rc6-1ubuntu12.7.0-1ubuntu1
2.7.0-1ubuntu1.1
openvpn
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-40215 is a medium vulnerability (CVSS 6.1) in Openvpn, published April 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in openvpn 2.6.20-r0.

References

Show 35 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open