OP
Product
OpenVPN
63
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 8High 26Medium 13Low 5
Watch
Add OpenVPN to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-27903 | 9.8 | Jul 8 | OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact… Affected: before 2.5.10; 2.6.0 before 2.6.10 |
| CVE-2023-46850 | 9.8 | Nov 11 | Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer Affected: 2.6.0 through 2.6.6 |
| CVE-2022-0547 | 9.8 | Mar 18 | OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies,… Affected: 2.1.0 before 2.4.12; 2.5.0 before 2.5.6 |
| CVE-2017-12166 | 9.8 | Oct 4 | OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution Affected: before 2.3.18; 2.4.0 before 2.4.4 |
| CVE-2026-13379 | 9.1 | Jul 30 | The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain… Affected: 2.7_alpha1 through 2.7.4 |
| CVE-2025-12106 | 9.1 | Dec 1 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses Affected: 2.6.13; 2.7; 2.7; 2.7; 2.7; 2.7; +2 more |
| CVE-2024-5594 | 9.1 | Jan 6 | OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs Affected: before 2.6.11 |
| CVE-2018-7544 | 9.1 | Mar 16 | A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5 Affected: through 2.4.5 |
| CVE-2024-4877 | 8.8 | Apr 3 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it… Affected: 2.4.0 before 2.6.11 |
| CVE-2026-84732 | 8.7 | Sep 7 | Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout… Affected: through 2.6.22; through 2.7.6 |
| CVE-2026-84226 | 8.5 | Sep 7 | OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps Affected: 2.5.0 through 2.6.22; 2.7_alpha1 through 2.7.6 |
| CVE-2026-12932 | 8.1 | Jul 30 | A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory… Affected: 2.5.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2026-12996 | 8.1 | Jul 30 | A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted… Affected: 2.6.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2026-13117 | 8.1 | Jul 30 | An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion,… Affected: 2.6.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2024-27459 | 7.8 | Jul 8 | The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges Affected: before 2.5.10; 2.6.0 before 2.6.10 |
| CVE-2021-3606 | 7.8 | Jul 2 | OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run… Affected: before 2.5.3 |
| CVE-2018-9336 | 7.8 | May 1 | openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the… Affected: 2.4.0 before 2.4.6 |
| CVE-2026-84256 | 7.7 | Sep 7 | An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted… Affected: 2.1_rc10 through 2.6.22; 2.7_alpha1 through 2.7.7 |
| CVE-2026-84790 | 7.6 | Oct 13 | OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field Affected: 2.7_alpha1 through 2.7.7 |
| CVE-2026-11771 | 7.5 | Jul 30 | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via… Affected: 2.1.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2026-13698 | 7.5 | Jul 6 | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to… Affected: 2.5.0 through 2.5.11; 2.6.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2025-13086 | 7.5 | Dec 3 | Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address… Affected: 2.6.0 before 2.6.16; 2.7; 2.7; 2.7; 2.7; 2.7; +2 more |
| CVE-2025-2704 | 7.5 | Apr 2 | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the… Affected: 2.6.1 through 2.6.13 |
| CVE-2024-24974 | 7.5 | Jul 8 | The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged… Affected: before 2.5.10; 2.6.0 before 2.6.10 |
| CVE-2023-46849 | 7.5 | Nov 11 | Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an… Affected: 2.6.0 through 2.6.6 |
| CVE-2020-20813 | 7.5 | Aug 22 | Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet Affected: through 2.4.7 |
| CVE-2020-15078 | 7.5 | Apr 26 | OpenVPN 2.5.1 and earlier versions allows a remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, which can… Affected: before 2.4.11; 2.5.0 before 2.5.2 |
| CVE-2017-7508 | 7.5 | Jun 27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet Affected: through 2.3.16; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +3 more |
| CVE-2017-7478 | 7.5 | May 15 | OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet Affected: 2.3.12; 2.3.13; 2.3.14; 2.4.0; 2.4.0; 2.4.0; +4 more |
| CVE-2026-40215 | 7.4 | Jun 8 | A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free… Affected: 2.6.0 through 2.6.19; 2.7_alpha1 through 2.7.1 |
| CVE-2021-3547 | 7.4 | Jul 12 | OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same… Affected: 3.6; 3.6.1 |
| CVE-2017-7520 | 7.4 | Jun 27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker Affected: through 2.3.16; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +3 more |
| CVE-2026-84471 | 7.2 | Oct 14 | The fix for CVE-2026-12996 was incomplete Affected: 2.6.0 through 2.6.22; 2.7_alpha1 through 2.7.7 |
| CVE-2026-88964 | 7.1 | Oct 13 | An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via… Affected: 2.7_alpha3 through 2.7.7 |
| CVE-2026-35058 | 6.5 | Jun 8 | Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a… Affected: 2.6.0 through 2.6.19; 2.7_alpha1 through 2.7.1 |
| CVE-2017-7522 | 6.5 | Jun 27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character Affected: through 2.3.16; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +3 more |
| CVE-2017-7479 | 6.5 | May 15 | OpenVPN versions before 2.3.15 and before 2.4.2 are vulnerable to reachable assertion when packet-ID counter rolls over resulting into Denial of Service of server by authenticated… Affected: through 2.3.14; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +2 more |
| CVE-2026-78221 | 5.9 | Sep 7 | An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose… Affected: 2.7_alpha1 through 2.7.6 |
| CVE-2017-7521 | 5.9 | Jun 27 | OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in… Affected: through 2.3.16; 2.4.0; 2.4.0; 2.4.0; 2.4.0; 2.4.0; +3 more |
| CVE-2016-6329 | 5.9 | Jan 31 | OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as… Affected: through 2.3.14 |
| CVE-2026-81830 | 5.6 | Sep 7 | The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path… Affected: 2.4.0 through 2.6.22 |
| CVE-2026-78043 | 5.6 | Sep 7 | The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary… Affected: 2.7_alpha1 through 2.7.6 |
| CVE-2025-13751 | 5.5 | Dec 3 | Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger… Affected: 2.5.0 before 2.6.17; 2.7; 2.7; 2.7; 2.7; 2.7; +3 more |
| CVE-2026-13122 | 5.3 | Jul 6 | OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a… Affected: 2.6.0 through 2.6.20; 2.7_alpha1 through 2.7.4 |
| CVE-2014-5455 | 5.3 | Aug 25 | Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to… Affected: 2.1.28.0 |
| CVE-2024-28882 | 4.3 | Jul 8 | OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session Affected: 2.6.0 before 2.6.11 |
| CVE-2026-63649 | 4.1 | Aug 14 | The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory… Affected: 2.4.0 before 2.6.22; 2.7_alpha1 before 2.7.6 |
| CVE-2025-15497 | 3.8 | Jan 30 | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service Affected: 2.7_alpha1 through 2.7_rc5 |
| CVE-2020-11810 | 3.7 | Apr 27 | An issue was discovered in OpenVPN 2.4.x before 2.4.9 Affected: 2.4.0 before 2.4.9 |
| CVE-2026-81738 | 2.3 | Sep 7 | OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries Affected: 2.5.0 through 2.7.6 |