CVE-2026-13117: Use After Free
An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.5.1-3Fixed in 2.5.1-3+deb11u4Fixed in 2.6.14-0+deb12u2Fixed in 2.6.14-1+deb13u3Fixed in 2.7.5-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13117?
The severity of CVE-2026-13117 is medium with a CVSS score of 6.
How do I fix CVE-2026-13117?
To fix CVE-2026-13117, update OpenVPN to version 2.6.21 or later if available.
What software is affected by CVE-2026-13117?
CVE-2026-13117 affects OpenVPN versions 2.6.0 to 2.6.20 and 2.7_alpha1 to 2.7.4.
What kind of vulnerability is CVE-2026-13117?
CVE-2026-13117 is a use-after-free vulnerability that can potentially lead to denial of service or memory leakage.
When was CVE-2026-13117 published?
CVE-2026-13117 was published on July 30, 2026.