Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-12932

Опубликовано: 30 июл. 2026
Источник: redhat
CVSS3: 7.5
EPSS Низкий

Описание

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

A flaw was found in OpenVPN. A memory leak in the tls-crypt-v2 client key extraction allows remote attackers to cause a denial of service (DoS). By sending a flood of specially crafted packets, an attacker can exhaust the system's memory, making the service unavailable.

Отчет

This vulnerability is rated as Important. A memory leak within the tls-crypt-v2 client key extraction mechanism of OpenVPN can be remotely triggered by an unauthenticated attacker. By sending a high volume of specially crafted packets, an attacker can exhaust system memory, leading to a denial of service for the OpenVPN service. This impact is significant due to the remote, unauthenticated nature of the attack.

Дополнительная информация

Статус:

Important
Дефект:
CWE-771
https://bugzilla.redhat.com/show_bug.cgi?id=2509521openvpn: OpenVPN: Denial of Service due to memory leak in tls-crypt-v2 client key extraction

EPSS

Процентиль: 35%
0.00417
Низкий

7.5 High

CVSS3

Связанные уязвимости

CVSS3: 8.1
ubuntu
19 дней назад

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

CVSS3: 8.1
nvd
19 дней назад

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

CVSS3: 8.1
debian
19 дней назад

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5 ...

CVSS3: 8.1
github
19 дней назад

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

suse-cvrf
7 дней назад

Security update for openvpn

EPSS

Процентиль: 35%
0.00417
Низкий

7.5 High

CVSS3