CVE-2026-84471
7.2HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-416
Impact
Authenticated peers can crash OpenVPN services or leak memory contents over the network. They only need valid credentials or TLS certificates to connect to the tunnel endpoint.
Root cause
An incomplete prior patch leaves an exploitable use-after-free condition during TLS session promotion or expiration handling.
Affected systems
OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade OpenVPN to version 2.6.23, 2.7.8, or later once available; no interim configuration workaround is specified in the advisory, so revoke suspicious peer certificates if an immediate upgrade is delayed.
$ sudo apt-get update && sudo apt-get install --only-upgrade openvpnAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.