CVE-2026-35058: Medium severity OpenVPN OpenVPN vulnerability
Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.6.14-0+deb12u1Fixed in 2.6.14-1+deb13u2Fixed in 2.7.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35058?
CVE-2026-35058 has a risk rating of 5, indicating a medium severity vulnerability.
Which software is affected by CVE-2026-35058?
CVE-2026-35058 affects the OpenVPN software on Debian platforms.
How do I fix CVE-2026-35058?
To mitigate CVE-2026-35058, users should update their OpenVPN packages to the latest version provided by Debian.
What type of vulnerability is CVE-2026-35058?
CVE-2026-35058 is classified as a medium risk vulnerability affecting security protocols in OpenVPN.
When was CVE-2026-35058 last updated?
CVE-2026-35058 was last updated on 21 May 2026.