OpenVPN CVE-2026-35058

OpenVPN's tls-crypt-v2 feature, introduced in version 2.5, wraps TLS handshake traffic with a per-client pre-shared HMAC key to provide an obfuscation and access-control layer before TLS negotiation begins. The root cause class is CWE-617 (Reachable Assertion): an internal invariant enforced by an ASSERT() macro in the server's packet processing code can be violated by attacker-controlled input. Critically, the malformed packet must first pass the tls-crypt-v2 HMAC/decryption check - meaning only packets carrying a cryptographically valid tls-crypt-v2 key reach the vulnerable assertion. When the assertion fires, the server process aborts abnormally, producing a complete availability failure. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P/VA:H/SA:H) confirms a network-reachable, high-availability-impact vulnerability where high complexity and present attack requirements reflect the need for precise packet construction and key possession. No CPE strings were included in the provided intelligence data.