CVE-2026-11771: High severity OpenVPN OpenVPN vulnerability
Last updated 8 July 2026
Other sources
OpenVPN version 2.1.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.6.14-0+deb12u2Fixed in 2.6.14-1+deb13u3Fixed in 2.7.5-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11771?
CVE-2026-11771 is classified as risk level 26, indicating a significant potential impact.
How do I fix CVE-2026-11771?
Fixing CVE-2026-11771 involves upgrading OpenVPN to a version higher than 2.6.20 or 2.7.4.
What versions of OpenVPN are affected by CVE-2026-11771?
CVE-2026-11771 affects OpenVPN versions 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4.
What vulnerability does CVE-2026-11771 exploit?
CVE-2026-11771 exploits an off-by-one buffer write in the NTLM proxy authentication.
Can CVE-2026-11771 lead to a system crash?
Yes, CVE-2026-11771 can potentially cause a system crash via a crafted NTLM response from a malicious proxy server.