Every CVE Search/ Get API key

CVE-2026-13379

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to...

5.1 Medium

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Passive

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

0.34%Up 0.1 points since Jul 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.1

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Record
CVE-2026-13379
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:N/SA:H
Weakness
CWE-142, CWE-125
Updated
2026-11-02
EUVDEUVD-2026-51233 5.1

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Record
EUVD-2026-51233
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:N/SA:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hpxm-29ww-fvf4 5.1

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to...

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Record
GHSA-hpxm-29ww-fvf4
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 5.1

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Record
CVE-2026-13379
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125, CWE-142
Updated
2026-11-02
OSV 5.1

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Record
CVE-2026-13379
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:N/SA:H
Weakness
CWE-125, CWE-142
Updated
2026-11-02
OSVUBUNTU-CVE-2026-13379 5.1

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Record
UBUNTU-CVE-2026-13379
CVSS 4.0
5.1 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:N/SA:H
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2026:11497-1 No score

openvpn-2.7.5-1.1 on GA media

These are all security issues fixed in the openvpn-2.7.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11497-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22072-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
openSUSE-SU-2026:22072-1
Updated
2026-11-02
OSVSUSE-SU-2026:24220-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
Record
SUSE-SU-2026:24220-1
Updated
2026-11-02
OSVSUSE-SU-2026:3596-1 No score

Security update for openvpn

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
Record
SUSE-SU-2026:3596-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openvpn
SUSE:Linux Enterprise Server 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1
openvpn
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1
openvpn
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn-dco
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn-dco
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn-dco
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 7 CVEs
 before 2.6.10-150600.3.26.1
2.6.10-150600.3.26.1
openvpn
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.7.5-1.1
2.7.5-1.1
openvpn
openSUSE:Leap 16.0
From an advisory covering 9 CVEs
 before 2.6.10-160000.5.1
2.6.10-160000.5.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-13379 is a medium vulnerability (CVSS 5.1) in Openvpn, published July 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. No source names a fixed version.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open