- p2mp server: improve handling of mbuf lists in the face of broadcast
-
or multicast traffic, and fix a bug on client exit that could lead
-
to a server queue deadlock in very particular scenarios.
+
- win32: tun: free gc arena in windows_set_mtu() (mem leak in error path)
-
Windows MSI changes since 2.7.7-I001:
-
* Update included dco-win driver to v2.8.13
-
* [CVE-2026-105390](https://www.cve.org/CVERecord?id=CVE-2026-105390) — a locking flaw allowed a local user with access to the driver's device to cause a system deadlock and denial of service, hanging the host until it was power-cycled.
-
* Performance improvements by moving to multi-core data processing. See [Release Notes](https://github.com/OpenVPN/ovpn-dco-win/releases/tag/2.8.13) for details.
-
* Update included OpenSSL to 3.6.5
-
* Update included Easy-RSA to 3.2.7
-
-
Note: Windows MSI was updated to I002 on October 22th. Changes in I002:
-
* Included dco-win driver updated to v2.8.14
-
* ([CVE-2026-115402](https://www.cve.org/CVERecord?id=CVE-2026-115402)) let a
-
TCP connect hold the socket open while its IRP is in flight - a teardown
-
during connect could close a socket WSK was still using, or complete the
-
same request twice, either of which can end in a bug check. Device removal
-
now cancels an in-flight connect instead of waiting for the transport.
-
* fix high CPU usage in System after a session ends - the TX ring was not
-
given back when there was no transport, so the queue stalled and
-
NetAdapterCx kept polling it (Github: [ovpn-dco-win/issues/164](https://github.com/OpenVPN/ovpn-dco-win/issues/164))
-
* the driver's merge module now ships a signed custom action DLL - it was
-
unsigned, so Smart App Control blocked it where enforced and the install
-
failed at OvpnDco_Evaluate with MSI error 1723
+
- route: close socket in Haiku get_default_gateway() (FD leak)
+
+
- win32: openvpnserv: skip conversion of empty domain names
+
+
- win32: cmake+mingw: don't prefix the event message DLL with lib
+
(it was building 'libopenvpnservmsg.dll' instead of 'openvpnservmsg.dll')
+
+
- win32: pass the buffer size in bytes to get_openvpn_reg_value()
+
+
- PUSH_UPDATE server: free temporary options after sending message (memleak)
+
+
+
### User-visible Changes
+
+
- Linux: set IFF_BACKPRESSURE on Linux (if available)
+
+
This helps the kernel tun/tap to apply proper prioritization (qdisc etc)
+
to incoming packets if userspace is slow to process them. Without the
+
flag, the kernel would just drop everything.
+
+
- Management/GUI: Optionally indicate username in >PASSWORD '<UP_TYPE>' prompts
+
+
If an openvpn config has a username set but no password, and OpenVPN
+
wants to prompt for the password, the GUI could not see the username
+
today and prompted for both. With this change, OpenVPN sends a hint to
+
the management interface, so a GUI can pre-fill the username field, or
+
only prompt for the password.
+
+
This is only done if the management interface client announces
+
support for it (compatibility level >= 6).
+
+
### Code improvements/general hardening
+
+
- crypto_epoch: wipe key material with secure_memzero()
+
+
- do not look up "none" cipher in OpenSSL - this avoids leaving an "error"
+
on the OpenSSL error stack, which can then later lead to spurious
+
SSL error prints on CRL loading.
+
+
- Make CRL reload EOF detection independent of stale error queue entries
