An incomplete guard in the `check_session_buf_not_used()` function in OpenVPN 2.6.x and 2.7.x fails to account for aliases in `tls_wrap_reneg.work.data` when dynamic tls-crypt-v2 is active. This allows a remote authenticated peer to trigger a use-after-free condition during TLS session promotion, potentially resulting in a server crash (denial of service) or the leakage of sensitive heap memory to the network peer. This issue is a bypass of the fix for [CVE-2026-40215](../CVE-2026-40215).
+
Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.6.20. This is fixed in versions 2.6.21 and 2.7.5.
