Home A - Z
Page Index

An Otter Wiki

Commit 1353e7

2026-07-01 14:43:01 flichtenheld: 2.6.21
ReleaseHistory.md ..
@@ 1,3 1,86 @@
+ ## OpenVPN 2.6.21 -- Released 1 July 2026
+ The OpenVPN community project team is proud to release OpenVPN 2.6.21. This is a bugfix release fixing
+ several security issues.
+
+ For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.21/Changes.rst)
+
+ Security fixes:
+
+ - Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed
+ sequence of control channel + authentication packets ([CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996))
+
+ Bug found by multiple researchers:
+ - 章鱼哥 (www.aipyaipy.com)
+ - Haiyang Huang
+ - Haruki Oyama (Waseda University)
+
+ - Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable
+ sequence of dynamic tls-crypt control-channel packets ([CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117))
+
+ Bug found by multiple researchers:
+ - Trace37 Labs (github.com/trace37labs)
+ - Haiyang Huang
+
+ - Fix server crash on reception of suitably malformed auth-token, if
+ `--auth-gen-token external-auth` is active ([CVE-2026-13122](https://www.cve.org/CVERecord?id=CVE-2026-13122))
+
+ Bug found by Haiyang Huang.
+
+ - Fix memory-leak in tls-crypt-v2 client key handling that could lead
+ to out-of-memory situations and subsequent server crashes ([CVE-2026-12932](https://www.cve.org/CVERecord?id=CVE-2026-12932))
+
+ Bug found by Valton Tahiri.
+
+ - Fix possible 1-byte buffer overrun on NTLMv2 proxy responses.
+ ([CVE-2026-11771](https://www.cve.org/CVERecord?id=CVE-2026-11771))
+
+ Bug found by Tristan Madani (@TristanInSec).
+
+ - Fix another memory leak on reception of suitable tls-crypt-v2 packets
+ that could lead to an out of memory situation and server crash
+ ([CVE-2026-13698](https://www.cve.org/CVERecord?id=CVE-2026-13698))
+
+ Bug found by Max Fillinger. Overlaps with a report
+ from Valton Tahiri that we believe to
+ be fixed by this bugfix as well.
+
+ Bugfixes
+ --------
+ - Windows: fix plugin trusted-dir check prefix bypass
+ (this fixes a bug in the path checking logic we do on Windows for
+ "is loading a plugin from this path allowed?", but since we could
+ not find a way to exploit this unless starting with admin privs or
+ a social engineering attack, not classified as a security fix)
+
+ - options: fix use-after-free of DNS options on client connect
+ (using suitable `--dns` or `--dhcp-option DNS` options in a server
+ config - not pushed, but applying to the server itself - triggers a
+ double free() and use-after-free condition, possibly crashing the
+ server) (Github: [OpenVPN/openvpn#1060](https://github.com/OpenVPN/openvpn/issues/1060))
+
+ - Null-terminate tls-crypt client keys when testing - non-exploitable
+ strlen() on a buffer that is not null-terminated
+
+ - Ensure pushed tun-mtu is no lower than TUN_MTU_MIN - this fixes a bug
+ where a server can push a suitable combination of options and make the
+ client ASSERT().
+
+ (Reported as security issue by Haiyang Huang,
+ but it was decided that the server always has means to make the client
+ "not function properly", and it can not be exploited beyond that)
+
+ Windows MSI changes since 2.6.20-I001:
+ * Built against OpenSSL 3.6.3
+
+ | | | |
+ |-|-|-|
+ |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-amd64.msi.asc)|[OpenVPN-2.6.21-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-amd64.msi)|
+ |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-arm64.msi.asc)|[OpenVPN-2.6.21-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-arm64.msi)|
+ |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-x86.msi.asc)|[OpenVPN-2.6.21-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-x86.msi)|
+ |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.21.tar.gz.asc)|[openvpn-2.6.21.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.21.tar.gz)|
+
+ For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
+
## OpenVPN 2.7.5 -- Released 1 July 2026
The OpenVPN community project team is proud to release OpenVPN 2.7.5. This is a bugfix release fixing
several security issues.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9