For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
+
+
## OpenVPN 2.6.20 -- Released 22 April 2026
+
The OpenVPN community project team is proud to release OpenVPN 2.6.20. This is a bugfix release containing security fixes.
+
+
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.20/Changes.rst)
+
+
Security fixes:
+
+
* [CVE-2026-40215](https://www.cve.org/CVERecord?id=CVE-2026-40215): fix race condition in TLS handshake that could lead to leaking of
+
packet data from a previous handshake under specific circumstances
+
* [CVE-2026-35058](https://www.cve.org/CVERecord?id=CVE-2026-35058): fix server ASSERT() on receiving a suitably malformed packet with
+
a valid tls-crypt-v2 key
+
+
Bugfixes:
+
+
* management: stop periodic bytecount output on mgmt client disconnection
+
* FreeBSD: make DCO work on systems with no IPv4 support
+
* FreeBSD: fix compilation with --enable-async-push on FreeBSD 15
+
* Linux: make DCO work on big endian architectures (MIPS, PowerPC)
+
* Windows: fix deinstallation progress bar on adapter deletion.
+
* Linux: fix problem with DCO kernel notifications getting lost, leading
+
to overcounting of number of connected clients and general confusion
+
between kernel and userland regarding peer status (Github [#900](https://github.com/OpenVPN/openvpn/issues/900), [#918](https://github.com/OpenVPN/openvpn/issues/918),
+
[#931](https://github.com/OpenVPN/openvpn/issues/931), [#919](https://github.com/OpenVPN/openvpn/issues/919), [#945](https://github.com/OpenVPN/openvpn/issues/945)) - this is a backport of the fixes in 2.7 plus the
+
infrastructural changes around DCO needed to support it.
+
+
Windows MSI changes since 2.6.19-I001:
+
* Built against OpenSSL 3.6.2
+
* Included openvpn-gui updated to 11.63.0.0
+
* Translation cleanup. Remove obsolete strings related to support for OpenVPN < 2.0
