CVE-2026-40215: Use After Free
A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.6.14-0+deb12u1Fixed in 2.6.14-1+deb13u2Fixed in 2.7.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40215?
CVE-2026-40215 has a risk rating of 30, indicating it poses a significant threat.
How do I fix CVE-2026-40215?
To fix CVE-2026-40215, update the Debian OpenVPN package to the latest version that addresses this vulnerability.
What systems are affected by CVE-2026-40215?
CVE-2026-40215 affects users of Debian OpenVPN software.
What type of vulnerability is CVE-2026-40215?
CVE-2026-40215 is classified as a security vulnerability that can potentially compromise system integrity.
When was CVE-2026-40215 last updated?
CVE-2026-40215 was last updated on 20 May 2026.