CVE-2026-13122
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A vulnerability in OpenVPN versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows a remote attacker to cause a denial of service by sending a malformed authentication token when external-auth is enabled. The issue is due to a reachable assertion in the code.
Risk Assessment
An attacker can remotely crash the OpenVPN server, disrupting VPN service and potentially causing network access loss for all users.
Recommendation
Immediately upgrade OpenVPN to version 2.6.21 or later, which includes the fix. If upgrading is not possible, temporarily disable the external-auth option.
Other vulnerabilities in OpenVPN
See all- CVE-2017-7520High
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.
- CVE-2017-7508High
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.
- CVE-2017-7478High
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. This issue is fixed in 2.3.15 and 2.4.2.
- CVE-2026-13379Critical
The Windows interactive service in OpenVPN (versions 2.7_alpha1 through 2.7.4) allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during disconnection.
- CVE-2025-12106Critical
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses.
- CVE-2023-46850Critical
OpenVPN versions 2.6.0 to 2.6.6 contain a use after free vulnerability that may lead to undefined behavior, leaking memory buffers, or remote code execution when sending network buffers to a remote peer.
- CVE-2017-12166Critical
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
- CVE-2026-84471High
Incomplete fix for CVE-2026-12996. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
- CVE-2026-88964High
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options.
- CVE-2026-84790High
OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field.
Original NVD description (English source)
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
Vulnerability data from NVD (NIST) · CISA KEV · EPSS