Home A - Z
Page Index

An Otter Wiki

Commit f8247c

2026-08-05 19:37:38 flichtenheld: 2.6.22
Downloads.md ..
@@ 65,7 65,7 @@
(Github: [OpenVPN/openvpn#1044](https://github.com/OpenVPN/openvpn/issues/1044)).
This was also reported (twice) as a security bug, as technically
- OpenVPN with ``--client-nat`` would read and write up to 4 bytes
+ OpenVPN with `--client-nat` would read and write up to 4 bytes
"after the end of the packet" - but due to the OpenVPN packet buffer
layouts, which are always full-frame-sized this is fully safe and has
no adverse consequences.
@@ 84,86 84,54 @@
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
- ## OpenVPN 2.6.21 -- Released 1 July 2026
- The OpenVPN community project team is proud to release OpenVPN 2.6.21. This is a bugfix release fixing
+ ## OpenVPN 2.6.22 -- Released 5 August 2026
+ The OpenVPN community project team is proud to release OpenVPN 2.6.22. This is a bugfix release fixing
several security issues.
- For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.21/Changes.rst)
+ For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.22/Changes.rst)
Security fixes:
- - Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed
- sequence of control channel + authentication packets ([CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996))
-
- Bug found by multiple researchers:
- - 章鱼哥 (www.aipyaipy.com)
- - Haiyang Huang
- - Haruki Oyama (Waseda University)
-
- - Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable
- sequence of dynamic tls-crypt control-channel packets ([CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117))
-
- Bug found by multiple researchers:
- - Trace37 Labs (github.com/trace37labs)
- - Haiyang Huang
-
- - Fix server crash on reception of suitably malformed auth-token, if
- `--auth-gen-token external-auth` is active ([CVE-2026-13122](https://www.cve.org/CVERecord?id=CVE-2026-13122))
-
- Bug found by Haiyang Huang.
-
- - Fix memory-leak in tls-crypt-v2 client key handling that could lead
- to out-of-memory situations and subsequent server crashes ([CVE-2026-12932](https://www.cve.org/CVERecord?id=CVE-2026-12932))
-
- Bug found by Valton Tahiri.
-
- - Fix possible 1-byte buffer overrun on NTLMv2 proxy responses.
- ([CVE-2026-11771](https://www.cve.org/CVERecord?id=CVE-2026-11771))
-
- Bug found by Tristan Madani (@TristanInSec).
-
- - Fix another memory leak on reception of suitable tls-crypt-v2 packets
- that could lead to an out of memory situation and server crash
- ([CVE-2026-13698](https://www.cve.org/CVERecord?id=CVE-2026-13698))
-
- Bug found by Max Fillinger. Overlaps with a report
- from Valton Tahiri that we believe to
- be fixed by this bugfix as well.
+ - openvpnserv (windows): better scrutinize command line passed in
+ from the control socket to openvpn. This would lead to circumventing
+ admin restrictions on allowed openvpn config directories (but never
+ to "read files the user has no permissions for") ([CVE-2026-63649](https://www.cve.org/CVERecord?id=CVE-2026-63649))
- Bugfixes:
+ Bug found by 章鱼哥 (www.aipyaipy.com)
- - Windows: fix plugin trusted-dir check prefix bypass
- (this fixes a bug in the path checking logic we do on Windows for
- "is loading a plugin from this path allowed?", but since we could
- not find a way to exploit this unless starting with admin privs or
- a social engineering attack, not classified as a security fix)
+ - dco: make key state desync recoverable
- - options: fix use-after-free of DNS options on client connect
- (using suitable `--dns` or `--dhcp-option DNS` options in a server
- config - not pushed, but applying to the server itself - triggers a
- double free() and use-after-free condition, possibly crashing the
- server) (Github: [OpenVPN/openvpn#1060](https://github.com/OpenVPN/openvpn/issues/1060))
+ This was reported as a "with suitable timing, a key-update de-sync between
+ OpenVPN and the kernel could trigger an ASSERT()", and was initially
+ handled as security report. It turned out to be not exploitable, but the
+ state machine was not very robust and so the opportunity was used to
+ improve the code.
- - Null-terminate tls-crypt client keys when testing - non-exploitable
- strlen() on a buffer that is not null-terminated
+ Bug found by 章鱼哥 (www.aipyaipy.com)
- - Ensure pushed tun-mtu is no lower than TUN_MTU_MIN - this fixes a bug
- where a server can push a suitable combination of options and make the
- client ASSERT().
+ Bugfixes:
+
+ - refuse incoming HARD RESET packets with a sequence ID != 0
+ (this is basically making an OpenVPN server ignore and log a
+ "should never happen" client-side misbehaviour, which could lead to
+ TLS handshake establishment failures in p2p TLS setups)
+
+ - correct minimum packet length check for 802.1q tagged packets
+ (Github: [OpenVPN/openvpn#1044](https://github.com/OpenVPN/openvpn/issues/1044)).
+
+ This was also reported (twice) as a security bug, as technically
+ OpenVPN with `--client-nat` would read and write up to 4 bytes
+ "after the end of the packet" - but due to the OpenVPN packet buffer
+ layouts, which are always full-frame-sized this is fully safe and has
+ no adverse consequences.
- (Reported as security issue by Haiyang Huang,
- but it was decided that the server always has means to make the client
- "not function properly", and it can not be exploited beyond that)
- Windows MSI changes since 2.6.20-I001:
- * Built against OpenSSL 3.6.3
-
| | | |
|-|-|-|
- |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-amd64.msi.asc)|[OpenVPN-2.6.21-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-amd64.msi)|
- |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-arm64.msi.asc)|[OpenVPN-2.6.21-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-arm64.msi)|
- |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-x86.msi.asc)|[OpenVPN-2.6.21-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-x86.msi)|
- |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.21.tar.gz.asc)|[openvpn-2.6.21.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.21.tar.gz)|
+ |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-amd64.msi.asc)|[OpenVPN-2.6.22-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-amd64.msi)|
+ |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-arm64.msi.asc)|[OpenVPN-2.6.22-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-arm64.msi)|
+ |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-x86.msi.asc)|[OpenVPN-2.6.22-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-x86.msi)|
+ |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.22.tar.gz.asc)|[openvpn-2.6.22.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.22.tar.gz)|
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9