Home A - Z
Page Index

An Otter Wiki

Commit 8a81ee

2026-07-01 14:35:40 flichtenheld: 2.6.21
Downloads.md ..
@@ 125,43 125,86 @@
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
- ## OpenVPN 2.6.20 -- Released 22 April 2026
- The OpenVPN community project team is proud to release OpenVPN 2.6.20. This is a bugfix release containing security fixes.
+ ## OpenVPN 2.6.21 -- Released 1 July 2026
+ The OpenVPN community project team is proud to release OpenVPN 2.6.21. This is a bugfix release fixing
+ several security issues.
- For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.20/Changes.rst)
+ For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.21/Changes.rst)
Security fixes:
- * [CVE-2026-40215](https://www.cve.org/CVERecord?id=CVE-2026-40215): fix race condition in TLS handshake that could lead to leaking of
- packet data from a previous handshake under specific circumstances
- * [CVE-2026-35058](https://www.cve.org/CVERecord?id=CVE-2026-35058): fix server ASSERT() on receiving a suitably malformed packet with
- a valid tls-crypt-v2 key
+ - Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed
+ sequence of control channel + authentication packets ([CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996))
+
+ Bug found by multiple researchers:
+ - 章鱼哥 (www.aipyaipy.com)
+ - Haiyang Huang
+ - Haruki Oyama (Waseda University)
+
+ - Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable
+ sequence of dynamic tls-crypt control-channel packets ([CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117))
+
+ Bug found by multiple researchers:
+ - Trace37 Labs (github.com/trace37labs)
+ - Haiyang Huang
+
+ - Fix server crash on reception of suitably malformed auth-token, if
+ `--auth-gen-token external-auth` is active ([CVE-2026-13122](https://www.cve.org/CVERecord?id=CVE-2026-13122))
+
+ Bug found by Haiyang Huang.
+
+ - Fix memory-leak in tls-crypt-v2 client key handling that could lead
+ to out-of-memory situations and subsequent server crashes ([CVE-2026-12932](https://www.cve.org/CVERecord?id=CVE-2026-12932))
+
+ Bug found by Valton Tahiri.
+
+ - Fix possible 1-byte buffer overrun on NTLMv2 proxy responses.
+ ([CVE-2026-11771](https://www.cve.org/CVERecord?id=CVE-2026-11771))
+
+ Bug found by Tristan Madani (@TristanInSec).
+
+ - Fix another memory leak on reception of suitable tls-crypt-v2 packets
+ that could lead to an out of memory situation and server crash
+ ([CVE-2026-13698](https://www.cve.org/CVERecord?id=CVE-2026-13698))
- Bugfixes:
-
- * management: stop periodic bytecount output on mgmt client disconnection
- * FreeBSD: make DCO work on systems with no IPv4 support
- * FreeBSD: fix compilation with --enable-async-push on FreeBSD 15
- * Linux: make DCO work on big endian architectures (MIPS, PowerPC)
- * Windows: fix deinstallation progress bar on adapter deletion.
- * Linux: fix problem with DCO kernel notifications getting lost, leading
- to overcounting of number of connected clients and general confusion
- between kernel and userland regarding peer status (Github [#900](https://github.com/OpenVPN/openvpn/issues/900), [#918](https://github.com/OpenVPN/openvpn/issues/918),
- [#931](https://github.com/OpenVPN/openvpn/issues/931), [#919](https://github.com/OpenVPN/openvpn/issues/919), [#945](https://github.com/OpenVPN/openvpn/issues/945)) - this is a backport of the fixes in 2.7 plus the
- infrastructural changes around DCO needed to support it.
-
- Windows MSI changes since 2.6.19-I001:
- * Built against OpenSSL 3.6.2
- * Included openvpn-gui updated to 11.63.0.0
- * Translation cleanup. Remove obsolete strings related to support for OpenVPN < 2.0
- * Translation updates.
+ Bug found by Max Fillinger. Overlaps with a report
+ from Valton Tahiri that we believe to
+ be fixed by this bugfix as well.
+
+ Bugfixes
+ --------
+ - Windows: fix plugin trusted-dir check prefix bypass
+ (this fixes a bug in the path checking logic we do on Windows for
+ "is loading a plugin from this path allowed?", but since we could
+ not find a way to exploit this unless starting with admin privs or
+ a social engineering attack, not classified as a security fix)
+
+ - options: fix use-after-free of DNS options on client connect
+ (using suitable `--dns` or `--dhcp-option DNS` options in a server
+ config - not pushed, but applying to the server itself - triggers a
+ double free() and use-after-free condition, possibly crashing the
+ server) (Github: [OpenVPN/openvpn#1060](https://github.com/OpenVPN/openvpn/issues/1060))
+
+ - Null-terminate tls-crypt client keys when testing - non-exploitable
+ strlen() on a buffer that is not null-terminated
+
+ - Ensure pushed tun-mtu is no lower than TUN_MTU_MIN - this fixes a bug
+ where a server can push a suitable combination of options and make the
+ client ASSERT().
+
+ (Reported as security issue by Haiyang Huang,
+ but it was decided that the server always has means to make the client
+ "not function properly", and it can not be exploited beyond that)
+
+ Windows MSI changes since 2.6.20-I001:
+ * Built against OpenSSL 3.6.3
| | | |
|-|-|-|
- |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-amd64.msi.asc)|[OpenVPN-2.6.20-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-amd64.msi)|
- |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-arm64.msi.asc)|[OpenVPN-2.6.20-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-arm64.msi)|
- |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-x86.msi.asc)|[OpenVPN-2.6.20-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-x86.msi)|
- |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.20.tar.gz.asc)|[openvpn-2.6.20.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.20.tar.gz)|
+ |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-amd64.msi.asc)|[OpenVPN-2.6.21-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-amd64.msi)|
+ |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-arm64.msi.asc)|[OpenVPN-2.6.21-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-arm64.msi)|
+ |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-x86.msi.asc)|[OpenVPN-2.6.21-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-x86.msi)|
+ |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.21.tar.gz.asc)|[openvpn-2.6.21.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.21.tar.gz)|
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9