OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openvpn | Aug 8, 2025 | Apr 2, 2025 |
| Amazon_linux_2023 | — | Upgrade openvpn-debuginfoUpgrade openvpn-develUpgrade openvpnUpgrade openvpn-debugsource | May 14, 2025 | Apr 2, 2025 |
| Debian | — | Upgrade openvpn | May 15, 2025 | Apr 2, 2025 |
| Freebsd | — | Upgrade openvpn-develUpgrade openvpn | Apr 4, 2025 | Apr 2, 2025 |
| Suse | — | Upgrade openvpn-dcoUpgrade openvpnUpgrade openvpn-dco-develUpgrade openvpn-develUpgrade openvpn-auth-pam-pluginUpgrade openvpn-down-root-plugin | May 8, 2025 | Apr 2, 2025 |
| Ubuntu | — | Upgrade openvpn | Apr 4, 2025 | Apr 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub