OpenVPN — свободная реализация технологии виртуальной частной сети (VPN) с открытым исходным кодом для создания зашифрованных каналoв типа точка-точка или сервер-клиенты между компьютерами.
Релизный цикл, информация об уязвимостях
График релизов
Количество 253
CVE-2026-13698
A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service
CVE-2026-13698
A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service
CVE-2026-13122
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
GHSA-m5x7-29rp-3xmr
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
GHSA-rwhm-c36w-484h
A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service
BDU:2026-09237
Уязвимость функции check_session_buf_not_used() механизма tls-crypt-v2 программного обеспечения OpenVPN, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации, вызвать отказ в обслуживании или выполнить произвольный код
CVE-2026-35058
Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.
CVE-2026-40215
A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.
CVE-2026-35058
Improper validation of packet length during tls-crypt-v2 key extractio ...
CVE-2026-40215
A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 throug ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2026-13698 A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service | CVSS3: 7.5 | 1% Низкий | 4 месяца назад |
 | CVE-2026-13698 A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service | CVSS3: 4.9 | 1% Низкий | 4 месяца назад |
| CVE-2026-13122 OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled | CVSS3: 5.3 | 0% Низкий | 4 месяца назад |
| GHSA-m5x7-29rp-3xmr OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled | CVSS3: 5.3 | 0% Низкий | 4 месяца назад |
| GHSA-rwhm-c36w-484h A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service | CVSS3: 7.5 | 1% Низкий | 4 месяца назад |
 | BDU:2026-09237 Уязвимость функции check_session_buf_not_used() механизма tls-crypt-v2 программного обеспечения OpenVPN, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации, вызвать отказ в обслуживании или выполнить произвольный код | CVSS3: 9.1 | 0% Низкий | 4 месяца назад |
 | CVE-2026-35058 Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet. | CVSS3: 6.5 | 1% Низкий | 5 месяцев назад |
| CVE-2026-40215 A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion. | CVSS3: 7.4 | 0% Низкий | 5 месяцев назад |
| CVE-2026-35058 Improper validation of packet length during tls-crypt-v2 key extractio ... | CVSS3: 6.5 | 1% Низкий | 5 месяцев назад |
| CVE-2026-40215 A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 throug ... | CVSS3: 7.4 | 0% Низкий | 5 месяцев назад |
Уязвимостей на страницу