CVE-2026-11771

OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2026-11771)

(CVE-2026-12932)

(CVE-2026-12996)

(CVE-2026-13117)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled(CVE-2026-13122)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2026-11771)

(CVE-2026-12932)

(CVE-2026-12996)

(CVE-2026-13117)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled(CVE-2026-13122)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

OpenVPN is a full-featured open source SSL VPN solution that accommodates a wide range of configurations, including remote access, site-to-site VPNs, Wi-Fi security, and enterprise-scale remote access solutions with load balancing, failover, and fine-grained access-controls. Starting with the fundamental premise that complexity is the enemy of security, OpenVPN offers a cost-effective, lightweight alternative to other VPN technologies that is well-adapted for the SME and enterprise markets.

Security Fix(es):

(CVE-2026-11771)

(CVE-2026-12932)

(CVE-2026-12996)

(CVE-2026-13117)

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled(CVE-2026-13122)

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service(CVE-2026-13698)

OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server

The updated packages fix security vulnerabilities: Possible 1-byte buffer overrun on NTLMv2 proxy responses. (CVE-2026-11771) Memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes. (CVE-2026-12932) Use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets. (CVE-2026-12996) Use-after-free bug in tls_wrap_reneg(), triggerable by suitable sequence of dynamic tls-crypt control-channel packets. (CVE-2026-13117) Server crash on reception of suitably malformed auth-token, if --auth-gen-token external-auth is active. (CVE-2026-13122) Another memory leak on reception of suitable tls-crypt-v2 packets that could lead to an out of memory situation and server crash. (CVE-2026-13698)

This update for openvpn fixes the following issues:

• CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
• CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
• CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
• CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
• CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
• CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
• CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
• CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
• CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).

This update for openvpn fixes the following issues:

• CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
• CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
• CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
• CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
• CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
• CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
• CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
• CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
• CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).

This update for openvpn fixes the following issues:

• CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
• CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
• CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
• CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
• CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
• CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
• CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).

It was discovered that OpenVPN had a 1-byte buffer overrun when handling NTLMv2 proxy responses. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-11771)

It was discovered that OpenVPN incorrectly handled metadata when extracting tls-crypt-v2 client keys. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-12932)

It was discovered that OpenVPN had a use-after-free in the ack_write_buf handling. An attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-12996)

It was discovered that OpenVPN had a use-after-free in the tls_wrap_reneg handling. An attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13117)

It was discovered that OpenVPN incorrectly validated authentication tokens when external authentication was enabled. A remote attacker could possibly use this issue to cause OpenVPN to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13122)

It was discovered that OpenVPN had a memory leak when handling tls-crypt-v2 client keys. A remote attacker with a valid tls-crypt-v2 client key could possibly use this issue to cause OpenVPN to consume excessive resources, leading to a denial of service. (CVE-2026-13698)