CVE-2026-12932: High severity OpenVPN OpenVPN vulnerability
A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.6.14-0+deb12u2Fixed in 2.6.14-1+deb13u3Fixed in 2.7.5-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12932?
CVE-2026-12932 has a risk score of 36, indicating it poses a significant threat to system stability.
How do I fix CVE-2026-12932?
To mitigate CVE-2026-12932, upgrade OpenVPN to version 2.6.21 or later.
What causes CVE-2026-12932?
CVE-2026-12932 is caused by a memory leak during the tls-crypt-v2 client key extraction in specific versions of OpenVPN.
What are the potential impacts of CVE-2026-12932?
CVE-2026-12932 can lead to denial of service through memory exhaustion due to a flood of crafted packets.
Which versions of OpenVPN are affected by CVE-2026-12932?
CVE-2026-12932 affects OpenVPN versions 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4.