CVE-2025-13086

| EUVD-2025-201102 HIGH
2025-12-03 [email protected]
7.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch Released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 16:14 euvd
EUVD-2025-201102
Analysis Generated
Mar 15, 2026 - 16:14 vuln.today
CVE Published
Dec 03, 2025 - 20:16 nvd
HIGH 7.5

Tags

Denial Of Service Ubuntu Debian Openvpn Redhat Suse

Description

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

Analysis

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

Technical Context

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users.

Affected Products

Affected products: Openvpn Openvpn

Remediation

Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +38
POC: 0

Vendor Status

Ubuntu

Priority: Medium
openvpn
Release Status Version
noble released 2.6.14-0ubuntu0.24.04.3
plucky released 2.6.14-0ubuntu0.25.04.3
questing released 2.6.14-2ubuntu1.1
trusty not-affected code not present
bionic not-affected -
focal not-affected -
jammy not-affected 2.5.11-0ubuntu0.22.04.1
upstream released 2.7.0,2.6.16,2.7.0~rc2-2
xenial not-affected -
USN-7898-1

Debian

Bug #1121086
openvpn
Release Status Fixed Version Urgency
bullseye not-affected - -
bullseye (security) fixed 2.5.1-3+deb11u2 -
bookworm, bookworm (security) fixed 2.6.3-1+deb12u4 -
trixie (security), trixie fixed 2.6.14-1+deb13u1 -
forky, sid fixed 2.7.0-1 -
experimental fixed 2.7.0~rc2-1 -
bookworm fixed 2.6.3-1+deb12u4 -
trixie fixed 2.6.14-1+deb13u1 -
(unstable) fixed 2.7.0~rc2-2 -
DSA-6069-1

Share

CVE-2025-13086 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy