openvpn: From CVEorg collector
Published Jul 6, 2026
6.0
MEDIUMCVSS 4.0
EPSS 0.55%
Description
A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service
Affected products
-
- Version 2.5.0StatusaffectedConstraints<=2.5.11
- Version 2.6.0StatusaffectedConstraints<=2.6.20
- Version 2.7_alpha1StatusaffectedConstraints<=2.7.4
- Version
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Red Hat statement
Moderate: A memory leak in OpenVPN could lead to a denial of service. This vulnerability requires a valid `tls-crypt-v2` client key, limiting the attack surface to authenticated remote attackers. While requiring authentication, repeated exploitation could exhaust system resources, impacting service availability on Red Hat supported OpenVPN deployments.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References (5)
- https://access.redhat.com/security/cve/CVE-2026-13698 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2497361 Issue Tracking
- https://community.openvpn.net/Security%20Announcements/CVE-2026-13698 vendor-advisoryVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-13698
- https://www.cve.org/CVERecord?id=CVE-2026-13698
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-13698 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2497361 | Issue Tracking | |
| https://community.openvpn.net/Security%20Announcements/CVE-2026-13698 | vendor-advisoryVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-13698 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-13698 |
Change history (0)
No recorded changes yet.