IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
4.6Mittel

CVE-2025-13086

OpenVPN OpenVPN Veröffentlicht: (vor 11 Monaten)

Beschreibung

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

Schwachstellentyp (CWE): CWE-940

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
OpenVPN OpenVPN 2.6.0 – ≤ 2.6.15, 2.7_alpha1 – ≤ 2.7_rc1

Referenzen und Patches

CPE-Treffer (NVD) (8)
  • cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:* ≥ 2.6.0 < 2.6.16
  • cpe:2.3:a:openvpn:openvpn:2.7:alpha1:*:*:community:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.7:alpha2:*:*:community:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.7:alpha3:*:*:community:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.7:beta1:*:*:community:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.7:beta2:*:*:community:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.7:beta3:*:*:community:*:*:*
  • cpe:2.3:a:openvpn:openvpn:2.7:rc1:*:*:community:*:*:*

Neue CVEs im selben Produkt — OpenVPN

6.3Mittel
CVE-2026-106017
OpenVPN OpenVPN 3 Core Library

Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.

7.2Hoch
CVE-2026-84471
OpenVPN OpenVPN

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion…

7.1Hoch
CVE-2026-88964
OpenVPN OpenVPN

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options

7.6Hoch
CVE-2026-84790
OpenVPN OpenVPN

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field

8.7Hoch
CVE-2026-84732
OpenVPN OpenVPN

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow

7.7Hoch
CVE-2026-84256
OpenVPN OpenVPN

An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject