USN-8852-1: OpenVPN vulnerabilities
Published Sep 30, 2026
·Updated
It was discovered that OpenVPN had a use-after-free vulnerability in its TLS session handling. An attacker could possibly use this issue to cause OpenVPN to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-84471) It was discovered that OpenVPN incorrectly handled retransmissions of ACK packet IDs, which could trigger a timeout integer overflow. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-84732)
Affected Software
7 affected componentsFixes available
OpenVPN OpenVPN
All of the following
ubuntu/openvpn<2.7.0-1ubuntu1.3
2.7.0-1ubuntu1.3
Ubuntu Ubuntu=26.04
All of the following
ubuntu/openvpn<2.6.19-0ubuntu0.24.04.4
2.6.19-0ubuntu0.24.04.4
Ubuntu Ubuntu=24.04
All of the following
ubuntu/openvpn<2.5.11-0ubuntu0.22.04.5
2.5.11-0ubuntu0.22.04.5
Ubuntu Ubuntu=22.04
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/openvpnto a version that resolves this vulnerability.Fixed in 2.7.0-1ubuntu1.3 - Upgrade
Upgrade
ubuntu/openvpnto a version that resolves this vulnerability.Fixed in 2.6.19-0ubuntu0.24.04.4 - Upgrade
Upgrade
ubuntu/openvpnto a version that resolves this vulnerability.Fixed in 2.5.11-0ubuntu0.22.04.5
Event History
Sep 30, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software