OP
Vendor
Openvpn
108
CVEs
0
On KEV
6
New 30D
Products
OP9.8
OpenVPN
Openvpn
63 CVEs0 on KEV3 new
OV6.9
ovpn-dco-win
OpenVPN
7 CVEs0 on KEV2 new
O36.3
OpenVPN 3 Core Library
OpenVPN
1 CVEs0 on KEV1 new
OA9.8
Openvpn Access Server
Openvpn
21 CVEs0 on KEV0 new
CO7.8
Connect
Openvpn
8 CVEs0 on KEV0 new
AS7.5
Access Server
OpenVPN
1 CVEs0 on KEV0 new
EA5.3
Easy-rsa
Openvpn
1 CVEs0 on KEV0 new
O36.5
Openvpn 3
Openvpn
1 CVEs0 on KEV0 new
OC7.5
OpenVPN Connect
OpenVPN
1 CVEs0 on KEV0 new
OG8.4
Openvpn Gui
Openvpn
1 CVEs0 on KEV0 new
OP6.2
Openvpn3linux
Openvpn
1 CVEs0 on KEV0 new
PT7.8
Private Tunnel
Openvpn
1 CVEs0 on KEV0 new
TA9.8
Tap-windows6
Openvpn
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115402 New | OV ovpn-dco-win OpenVPN | 5.7 | Oct 28 | OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path |
| CVE-2026-106017 New | O3 OpenVPN 3 Core Library OpenVPN | 6.3 | Oct 22 | Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions |
| CVE-2026-84471 | OP OpenVPN OpenVPN | 7.2 | Oct 14 | The fix for CVE-2026-12996 was incomplete |
| CVE-2026-105390 | OV ovpn-dco-win OpenVPN | 6.9 | Oct 13 | Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted… |
| CVE-2026-88964 | OP OpenVPN OpenVPN | 7.1 | Oct 13 | An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via… |
| CVE-2026-84790 | OP OpenVPN OpenVPN | 7.6 | Oct 13 | OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field |
| CVE-2026-82325 | OV ovpn-dco-win OpenVPN | 6.8 | Sep 7 | A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages |
| CVE-2026-84732 | OP OpenVPN OpenVPN | 8.7 | Sep 7 | Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout… |
| CVE-2026-84256 | OP OpenVPN OpenVPN | 7.7 | Sep 7 | An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted… |
| CVE-2026-84226 | OP OpenVPN OpenVPN | 8.5 | Sep 7 | OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during network configuration steps |
| CVE-2026-82312 | OP OpenVPN OpenVPN | 1.8 | Sep 7 | OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects |
| CVE-2026-81830 | OP OpenVPN OpenVPN | 5.6 | Sep 7 | The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path… |
| CVE-2026-81738 | OP OpenVPN OpenVPN | 2.3 | Sep 7 | OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries |
| CVE-2026-78221 | OP OpenVPN OpenVPN | 5.9 | Sep 7 | An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose… |
| CVE-2026-78043 | OP OpenVPN OpenVPN | 5.6 | Sep 7 | The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary… |
| CVE-2026-63650 | OP OpenVPN OpenVPN | 2.0 | Aug 14 | OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field |
| CVE-2026-63649 | OP OpenVPN OpenVPN | 4.1 | Aug 14 | The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory… |
| CVE-2026-12932 | OP OpenVPN OpenVPN | 8.1 | Jul 30 | A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory… |
| CVE-2026-12996 | OP OpenVPN OpenVPN | 8.1 | Jul 30 | A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted… |
| CVE-2026-11771 | OP OpenVPN OpenVPN | 7.5 | Jul 30 | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via… |
| CVE-2026-13117 | OP OpenVPN OpenVPN | 8.1 | Jul 30 | An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion,… |
| CVE-2026-13379 | OP OpenVPN OpenVPN | 9.1 | Jul 30 | The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain… |
| CVE-2025-3110 | AS Access Server OpenVPN | 7.5 | Jul 8 | OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed… |
| CVE-2026-13122 | OP OpenVPN Openvpn | 5.3 | Jul 6 | OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a… |
| CVE-2026-13698 | OP OpenVPN OpenVPN | 7.5 | Jul 6 | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to… |
| CVE-2026-11604 | OV ovpn-dco-win OpenVPN | 6.5 | Jun 10 | An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based… |
| CVE-2026-40215 | OP OpenVPN OpenVPN | 7.4 | Jun 8 | A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free… |
| CVE-2026-35058 | OP OpenVPN OpenVPN | 6.5 | Jun 8 | Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a… |
| CVE-2026-9560 | CO Connect Openvpn | 7.8 | May 26 | Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC… |
| CVE-2026-2738 | OV ovpn-dco-win OpenVPN | 5.6 | Feb 19 | Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end… |
| CVE-2025-15497 | OP OpenVPN OpenVPN | 3.8 | Jan 30 | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service |
| CVE-2025-13086 | OP Openvpn Openvpn | 7.5 | Dec 3 | Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address… |
| CVE-2025-13751 | OP Openvpn Openvpn | 5.5 | Dec 3 | Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger… |
| CVE-2025-12106 | OP Openvpn Openvpn | 9.1 | Dec 1 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses |
| CVE-2025-50054 | OV Ovpn-dco-win Openvpn | 5.5 | Jun 20 | Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to the… |
| CVE-2025-3908 | OP Openvpn3linux Openvpn | 6.2 | May 19 | The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the… |
| CVE-2024-4877 | OP Openvpn Openvpn | 8.8 | Apr 3 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it… |
| CVE-2025-2704 | OP Openvpn Openvpn | 7.5 | Apr 2 | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the… |
| CVE-2024-13454 | EA Easy-rsa Openvpn | 5.3 | Jan 20 | Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenSSL 3 |
| CVE-2024-5198 | OV Ovpn-dco-win Openvpn | 3.3 | Jan 15 | OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer… |
| CVE-2024-8474 | OC OpenVPN Connect OpenVPN | 7.5 | Jan 6 | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to… |
| CVE-2024-5594 | OP OpenVPN OpenVPN | 9.1 | Jan 6 | OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs |
| CVE-2024-28882 | OP Openvpn Openvpn | 4.3 | Jul 8 | OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session |
| CVE-2024-1305 | TA Tap-windows6 Openvpn | 9.8 | Jul 8 | tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting… |
| CVE-2024-27903 | OP Openvpn Openvpn | 9.8 | Jul 8 | OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact… |
| CVE-2024-27459 | OP Openvpn Openvpn | 7.8 | Jul 8 | The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges |
| CVE-2024-24974 | OP Openvpn Openvpn | 7.5 | Jul 8 | The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with the privileged… |
| CVE-2023-6247 | O3 Openvpn 3 Openvpn | 6.5 | Feb 29 | The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the application crashing |
| CVE-2023-7235 | OG Openvpn Gui Openvpn | 8.4 | Feb 21 | The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard… |
| CVE-2023-7245 | CO Connect Openvpn | 7.8 | Feb 20 | The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the… |
| CVE-2023-7224 | CO Connect Openvpn | 7.8 | Jan 8 | OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable |
| CVE-2023-46850 | OP Openvpn Openvpn | 9.8 | Nov 11 | Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer |
| CVE-2023-46849 | OP Openvpn Openvpn | 7.5 | Nov 11 | Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an… |
| CVE-2022-3761 | CO Connect Openvpn | 5.9 | Oct 17 | OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download… |
| CVE-2020-20813 | OP Openvpn Openvpn | 7.5 | Aug 22 | Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet |
| CVE-2021-4234 | OA Openvpn Access Server Openvpn | 7.5 | Jul 6 | OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the client which the client again does not… |
| CVE-2022-33738 | OA Openvpn Access Server Openvpn | 7.5 | Jul 6 | OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal |
| CVE-2022-33737 | OA Openvpn Access Server Openvpn | 7.5 | Jul 6 | The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password |
| CVE-2022-0547 | OP Openvpn Openvpn | 9.8 | Mar 18 | OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies,… |
| CVE-2021-3824 | OA Openvpn Access Server Openvpn | 6.1 | Sep 23 | OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL |