CVE-2026-84471: Use After Free
Last updated 30 September 2026
Other sources
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.7.7-1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be a remote authenticated OpenVPN peer. The issue is triggered by crafted packets during TLS session promotion or expiry.
Which OpenVPN versions are affected?
Affected versions are OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7.
What is the potential impact?
A successful attack may cause a denial of service or leak memory due to a use-after-free condition.