Home A - Z
Page Index

An Otter Wiki

Commit 66e55d

2026-07-23 14:22:58 flichtenheld: -/-
Security Announcements/CVE-2026-12932.md ..
@@ 1,3 1,16 @@
- # CVE-2026-12932
+ # CVE-2026-12932 - memory leak using `--tls-crypt-v2`
- TBD
+ A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5+ allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets.
+
+ OpenVPN version 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 are affected. This is fixed in versions 2.6.21 and 2.7.5.
+
+ CVE Record: [CVE-2026-12932](https://www.cve.org/CVERecord?id=CVE-2026-12932)
+
+ Github:
+ * [OpenVPN/openvpn-private-issues#133](https://github.com/OpenVPN/openvpn-private-issues/issues/133)
+
+ Release notes:
+ * [openvpn-2.7.5](https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026)
+ * [openvpn-2.6.21](https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026)
+
+ Reported-By: Valton Taa
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9