Skip to main content

Ubuntu CVE-2025-13086

| EUVD-2025-201102 HIGH
Improper Verification of Source of a Communication Channel (CWE-940)
2025-12-03 security@openvpn.net
Denial Of Service Ubuntu Debian Openvpn Red Hat Suse
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
HIGH
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 16:14 euvd
EUVD-2025-201102
Analysis Generated
Mar 15, 2026 - 16:14 vuln.today
CVE Published
Dec 03, 2025 - 20:16 nvd
HIGH 7.5

DescriptionCVE.org

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

Analysis

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users.

RemediationAI

Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

Vendor StatusVendor

Ubuntu

Priority: Medium
openvpn
Release Status Version
noble released 2.6.14-0ubuntu0.24.04.3
plucky released 2.6.14-0ubuntu0.25.04.3
questing released 2.6.14-2ubuntu1.1
trusty not-affected code not present
bionic not-affected -
focal not-affected -
jammy not-affected 2.5.11-0ubuntu0.22.04.1
upstream released 2.7.0,2.6.16,2.7.0~rc2-2
xenial not-affected -
USN-7898-1

Debian

Bug #1121086
openvpn
Release Status Fixed Version Urgency
bullseye not-affected - -
bullseye (security) fixed 2.5.1-3+deb11u2 -
bookworm, bookworm (security) fixed 2.6.3-1+deb12u4 -
trixie (security), trixie fixed 2.6.14-1+deb13u1 -
forky, sid fixed 2.7.0-1 -
experimental fixed 2.7.0~rc2-1 -
bookworm fixed 2.6.3-1+deb12u4 -
trixie fixed 2.6.14-1+deb13u1 -
(unstable) fixed 2.7.0~rc2-2 -
DSA-6069-1

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-5.6 Affected
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP6 Fixed

Share

CVE-2025-13086 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy