Skip to main content

OpenVPN EUVDEUVD-2026-35197

| CVE-2026-35058 MEDIUM
Reachable Assertion (CWE-617)
2026-04-22
Information Disclosure Openvpn
6.9
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
5.3 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
Jun 08, 2026 - 20:25 vuln.today
Analysis Generated
Jun 08, 2026 - 20:25 vuln.today
CVSS changed
Jun 08, 2026 - 20:22 NVD
6.9 (MEDIUM)
Patch released
Apr 24, 2026 - 12:21 nvd
Patch available
CVE Published
Apr 22, 2026 - 19:46 nvd
N/A

Description PRE-NVD

Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.

AnalysisAI

Remote denial-of-service in OpenVPN server allows a low-privileged network attacker possessing a valid tls-crypt-v2 client key to crash the server daemon by sending a suitably malformed packet that passes cryptographic validation but triggers a fatal ASSERT() failure, terminating the server process and disconnecting all active VPN sessions. The vulnerability is limited to deployments with tls-crypt-v2 enabled and requires possession of a legitimate client key, constraining the attacker pool. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

OpenVPN's tls-crypt-v2 feature, introduced in version 2.5, wraps TLS handshake traffic with a per-client pre-shared HMAC key to provide an obfuscation and access-control layer before TLS negotiation begins. The root cause class is CWE-617 (Reachable Assertion): an internal invariant enforced by an ASSERT() macro in the server's packet processing code can be violated by attacker-controlled input. Critically, the malformed packet must first pass the tls-crypt-v2 HMAC/decryption check - meaning only packets carrying a cryptographically valid tls-crypt-v2 key reach the vulnerable assertion. When the assertion fires, the server process aborts abnormally, producing a complete availability failure. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P/VA:H/SA:H) confirms a network-reachable, high-availability-impact vulnerability where high complexity and present attack requirements reflect the need for precise packet construction and key possession. No CPE strings were included in the provided intelligence data.

RemediationAI

Upgrade OpenVPN to v2.6.20 (for the 2.6.x branch) or v2.7.2 (for the 2.7.x branch), both released 22 April 2026. The official GitHub release containing the fix is at https://github.com/OpenVPN/openvpn/releases/tag/v2.6.20. Ubuntu users should apply the package updates described in USN-8286-1 at https://ubuntu.com/security/notices/USN-8286-1. Windows community installers are available at https://openvpn.net/community-downloads/. For operators unable to patch immediately, disabling tls-crypt-v2 and reverting to tls-crypt or tls-auth removes the vulnerable code path entirely, though it eliminates per-client key isolation - a security regression that should be weighed against the DoS exposure. Alternatively, restricting which clients receive tls-crypt-v2 keys reduces the attacker pool but does not prevent exploitation by any current key holder. Firewall rules restricting OpenVPN port access to known client IP ranges provide additional perimeter reduction but cannot fully substitute for patching.

More in Openvpn

View all
CVE-2018-7544 CRITICAL POC
9.1 Mar 16

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
CVE-2017-7478 HIGH POC
7.5 May 15

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
CVE-2020-9442 HIGH POC
7.8 Feb 28

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
CVE-2018-9336 HIGH POC
7.8 May 01

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2019-25429 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
CVE-2019-25428 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
CVE-2017-12166 CRITICAL
9.8 Oct 04

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
CVE-2024-1305 CRITICAL
9.8 Jul 08

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
CVE-2024-27903 CRITICAL
9.8 Jul 08

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

EUVD-2026-35197 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy