Blame
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 1 | ## OpenVPN 2.7.8 -- Released 7 October 2026 |
| 2 | The OpenVPN community project team is proud to release OpenVPN 2.7.8. This is a bugfix release fixing |
|||
| 3 | several security issues. |
|||
| 39396b | flichtenheld | 2026-07-01 13:37:52 | 4 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 5 | For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.8/Changes.rst) |
| 39396b | flichtenheld | 2026-07-01 13:37:52 | 6 | |
| 7 | Security fixes: |
|||
| 8 | ||||
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 9 | - Check for NULL-Bytes in certificate subjects - refuse all such certificates |
| 10 | now as "invalid" ([CVE-2026-84790](https://www.cve.org/CVERecord?id=CVE-2026-84790)). |
|||
| ef2447 | uddr | 2026-09-03 14:33:00 | 11 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 12 | (Bug reported by Vivek Parikh, tracked in |
| 13 | Github: OpenVPN/openvpn-private-issues#163) |
|||
| ef2447 | uddr | 2026-09-03 14:33:00 | 14 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 15 | - TLS handshake with tls-crypt-v2: do not try to add a wrapped client key |
| 16 | if no key material is available (client bug in response to an ill-behaving |
|||
| 17 | server). |
|||
| ef2447 | uddr | 2026-09-03 14:33:00 | 18 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 19 | (No CVE assigned as "a malicious server can stop the client from working |
| 20 | properly" is not considered a CVE-worthy security issue according to the |
|||
| 21 | CRA guidelines) |
|||
| ef2447 | uddr | 2026-09-03 14:33:00 | 22 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 23 | - options: fix unsigned underflow when clearing domain_search_list |
| 24 | ([CVE-2026-88964](https://www.cve.org/CVERecord?id=CVE-2026-84964)) |
|||
| 39396b | flichtenheld | 2026-07-01 13:37:52 | 25 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 26 | (Bug reported and fix contributed by Cole Munz, |
| 27 | tracked in Github: OpenVPN/openvpn-private-issues#178) |
|||
| 39396b | flichtenheld | 2026-07-01 13:37:52 | 28 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 29 | - win32: stop cmd.exe from expanding variables in quoted arguments |
| 30 | ([CVE-2026-84256](https://www.cve.org/CVERecord?id=CVE-2026-84256)) |
|||
| 39396b | flichtenheld | 2026-07-01 13:37:52 | 31 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 32 | (Bug reported by Darren Carreras, tracked in Github: |
| 33 | OpenVPN/openvpn-private-issues#176) |
|||
| ef2447 | uddr | 2026-09-03 14:33:00 | 34 | |
| 35 | User-visible Changes: |
|||
| 36 | ||||
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 37 | - Certificate validation is now stricter regarding NULL bytes in strings |
| 38 | (see above). This might break existing installations if such certificates |
|||
| 39 | exist and OpenSSL builds are used. mbedTLS builds always rejected this. |
|||
| ef2447 | uddr | 2026-09-03 14:33:00 | 40 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 41 | - On a certificate with duplicate fields (multiple CN, for example) OpenSSL |
| 42 | builds would use the last one, mbedTLS builds use the first one - changed |
|||
| 43 | in the mbedTLS build so behaviour is identical. |
|||
| ef2447 | uddr | 2026-09-03 14:33:00 | 44 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 45 | Bugfixes: |
| 6e939a | flichtenheld | 2026-07-01 14:44:18 | 46 | |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 47 | - DCO: remove installed iroutes at client exit time, not at delayed |
| 48 | multi instance cleanup time - otherwise there is a race with reconnecting |
|||
| 49 | clients, possibly ending up having "no iroutes installed in the system |
|||
| 50 | at all". Bug reported by OpenVPN Inc Access Server team. |
|||
| 51 | ||||
| 52 | - DCO Linux: fix remaining races between synchronous netlink operations |
|||
| 53 | and incoming asynchronous notifications, by adding a second netlink socket |
|||
| 54 | and strictly separating sync/async operations. |
|||
| 55 | ||||
| 56 | - Client: refuse incoming pushed option combination of epoch data format |
|||
| 57 | with non-AEAD ciphers (restart session instead of aborting with a fatal |
|||
| 58 | error). |
|||
| 59 | ||||
| 60 | - DCO (Linux and Windows): on failures to set up a new peer or install |
|||
| 61 | key materials for a peer, do not exit OpenVPN with a fatal error. Instead, |
|||
| 62 | signal the error up the call-chain and restart the (multi) instance. |
|||
| 63 | ||||
| 64 | The handshake is inherently racy when a peer is removed kernel-side |
|||
| 65 | due to transport errors or timeouts, and userland does not yet know this |
|||
| 66 | and wants to, for example, install new keys. This is fatal for the |
|||
| 67 | particular client instance, but must not end the whole server process. |
|||
| 68 | ||||
| 69 | - DCO: stop fetching peer stats during client disconnect |
|||
| 70 | The intention of the original code was to ensure reported counters |
|||
| 71 | are always correct, but it did not work (because at query time, the peer |
|||
| 72 | in kernel is already gone, so we only got an error message) - and very |
|||
| 73 | inefficiently so (because we queried all the peers all the time). |
|||
| 74 | End-of-session final counter values will be implemented properly by a |
|||
| 75 | followup patch leveraging counters piggybacked on the kernel's |
|||
| 76 | "DEL_PEER" notification message. |
|||
| 77 | ||||
| 78 | - p2mp server: improve handling of mbuf lists in the face of broadcast |
|||
| 79 | or multicast traffic, and fix a bug on client exit that could lead |
|||
| 80 | to a server queue deadlock in very particular scenarios. |
|||
| c8181c | flichtenheld | 2026-06-10 16:39:29 | 81 | |
| 79c55a | flichtenheld | 2026-10-07 12:18:43 | 82 | Windows MSI changes since 2.7.7-I001: |
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 83 | * Update included dco-win driver to v2.8.13 |
| 84 | * [CVE-2026-105390](https://www.cve.org/CVERecord?id=CVE-2026-105390) — a locking flaw allowed a local user with access to the driver's device to cause a system deadlock and denial of service, hanging the host until it was power-cycled. |
|||
| 85 | * Performance improvements by moving to multi-core data processing. See [Release Notes](https://github.com/OpenVPN/ovpn-dco-win/releases/tag/2.8.13) for details. |
|||
| 86 | * Update included OpenSSL to 3.6.5 |
|||
| 1fcf91 | flichtenheld | 2026-10-07 15:03:19 | 87 | * Update included Easy-RSA to 3.2.7 |
| 21a0aa | flichtenheld | 2026-03-31 15:00:25 | 88 | |
| e028c0 | uddr | 2026-10-22 15:51:27 | 89 | Note: Windows MSI was updated to I002 on October 22th. Changes in I002: |
| 90 | * Included dco-win driver updated to v2.8.14 |
|||
| 91 | * ([CVE-2026-115402](https://www.cve.org/CVERecord?id=CVE-2026-115402)) let a |
|||
| 92 | TCP connect hold the socket open while its IRP is in flight - a teardown |
|||
| 93 | during connect could close a socket WSK was still using, or complete the |
|||
| 94 | same request twice, either of which can end in a bug check. Device removal |
|||
| 95 | now cancels an in-flight connect instead of waiting for the transport. |
|||
| 96 | * fix high CPU usage in System after a session ends - the TX ring was not |
|||
| 97 | given back when there was no transport, so the queue stalled and |
|||
| 98 | NetAdapterCx kept polling it (Github: [ovpn-dco-win/issues/164](https://github.com/OpenVPN/ovpn-dco-win/issues/164)) |
|||
| 501080 | Lev Stipakov | 2026-10-22 16:23:39 | 99 | * the driver's merge module now ships a signed custom action DLL - it was |
| 100 | unsigned, so Smart App Control blocked it where enforced and the install |
|||
| 101 | failed at OvpnDco_Evaluate with MSI error 1723 |
|||
| e028c0 | uddr | 2026-10-22 15:51:27 | 102 | |
| 99ee06 | flichtenheld | 2025-07-31 19:24:29 | 103 | | | | | |
| 104 | |-|-|-| |
|||
| e028c0 | uddr | 2026-10-22 15:51:27 | 105 | |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-amd64.msi.asc)|[OpenVPN-2.7.8-I002-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-amd64.msi)| |
| 106 | |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-arm64.msi.asc)|[OpenVPN-2.7.8-I002-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-arm64.msi)| |
|||
| 107 | |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-x86.msi.asc)|[OpenVPN-2.7.8-I002-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-x86.msi)| |
|||
| 5cd413 | flichtenheld | 2026-10-07 12:17:37 | 108 | |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.8.tar.gz.asc)|[openvpn-2.7.8.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.8.tar.gz)| |
| 99ee06 | flichtenheld | 2025-07-31 19:24:29 | 109 | |
| 21a0aa | flichtenheld | 2026-03-31 15:00:25 | 110 | For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). |
| 687bbf | novaflash | 2025-06-20 17:21:18 | 111 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 112 | ## OpenVPN 2.6.23 -- Released 23 September 2026 |
| 113 | The OpenVPN community project team is proud to release OpenVPN 2.6.23. This is a bugfix release fixing |
|||
| 8a81ee | flichtenheld | 2026-07-01 14:35:40 | 114 | several security issues. |
| 23ddda | flichtenheld | 2026-02-04 14:22:30 | 115 | |
| d2738c | flichtenheld | 2026-08-06 15:19:11 | 116 | > [!IMPORTANT] |
| 557498 | flichtenheld | 2026-09-23 16:01:44 | 117 | > After 2.6.22 release the [support status](../Pages/Supported%20versions) of OpenVPN 2.6 changed from "Full Support" to "Old Stable Support". |
| 6a9a91 | flichtenheld | 2026-10-07 16:13:18 | 118 | > This means that we might not provide Windows installer downloads of future 2.6.x releases. |
| d2738c | flichtenheld | 2026-08-06 15:19:11 | 119 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 120 | For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.23/Changes.rst) |
| 485d55 | flichtenheld | 2026-02-04 18:03:20 | 121 | |
| a92ca4 | uddr | 2026-04-22 15:02:45 | 122 | Security fixes: |
| 23ddda | flichtenheld | 2026-02-04 14:22:30 | 123 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 124 | - ssl: do not trust the peer's request to resend the wrapped client key |
| 8a81ee | flichtenheld | 2026-07-01 14:35:40 | 125 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 126 | Tracked in Github: OpenVPN/openvpn-private-issues#181 |
| 6e939a | flichtenheld | 2026-07-01 14:44:18 | 127 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 128 | - reliability layer: avoid unbounded reliable TLS timeout, and ignore acks |
| 129 | for packets that cannot be outstanding ([CVE-2026-84732](https://www.cve.org/CVERecord?id=CVE-2026-84732)) |
|||
| 8a81ee | flichtenheld | 2026-07-01 14:35:40 | 130 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 131 | Both reliability layer bugs found by Mark Bregman (Fox-IT), tracked in |
| 132 | Github: OpenVPN/openvpn-private-issues#161 |
|||
| 8a81ee | flichtenheld | 2026-07-01 14:35:40 | 133 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 134 | - improve on `check_session_buf_not_used()`, catch possible double-free in |
| 135 | the lame duck case ([CVE-2026-84471](https://www.cve.org/CVERecord?id=CVE-2026-84471)) |
|||
| 8a81ee | flichtenheld | 2026-07-01 14:35:40 | 136 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 137 | Bug reported by Andreas Gabriel Berbescu, tracked in Github: |
| 138 | OpenVPN/openvpn-private-issues#157, and by Haruki Oyama (Waseda |
|||
| 139 | University), tracked in OpenVPN/openvpn-private-issues#132 |
|||
| f8247c | flichtenheld | 2026-08-05 19:37:38 | 140 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 141 | - windows: fix `CreateProcess()` command line quoting for characters that |
| 142 | are special to `cmd.exe`, where a combination of validation script plus |
|||
| 143 | rogue CA could lead to misbehavior ([CVE-2026-84256](https://www.cve.org/CVERecord?id=CVE-2026-84256)) |
|||
| f8247c | flichtenheld | 2026-08-05 19:37:38 | 144 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 145 | Bug found by Clouditera Security, tracked in Github: |
| 146 | OpenVPN/openvpn-private-issues#159 |
|||
| f8247c | flichtenheld | 2026-08-05 19:37:38 | 147 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 148 | - windows: fix `tapctl` to always call `netsh.exe` with full path |
| 149 | (as we do elsewhere) ([CVE-2026-84226](https://www.cve.org/CVERecord?id=CVE-2026-84226)) |
|||
| 8a81ee | flichtenheld | 2026-07-01 14:35:40 | 150 | |
| 30bd51 | uddr | 2026-09-23 14:18:40 | 151 | Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2), tracked in |
| 152 | Github: OpenVPN/openvpn-private-issues#164 |
|||
| 153 | ||||
| 154 | - windows: don't use NULL DACL with system objects, namely the `--service` |
|||
| 155 | exit event and the `netsh.exe` guard semaphore. The old approach was |
|||
| 156 | prone to a local DoS where one user could interfere with other users' |
|||
| 157 | openvpn processes by blocking the netsh semaphore or sending events. |
|||
| 158 | This only affects setups not using the iservice, or using the automatic |
|||
| 159 | service to start/stop openvpn ([CVE-2026-82312](https://www.cve.org/CVERecord?id=CVE-2026-82312)) |
|||
| 160 | ||||
| 161 | Bug found by DEBRAJ BASAK, tracked in Github: |
|||
| 162 | OpenVPN/openvpn-private-issues#167 |
|||
| 163 | ||||
| 164 | - dhcp (windows): fix off-by-one in `write_dhcp_search_str()` temp buffer |
|||
| 165 | guard - suitable DHCP options could lead to a single-byte overflow of a |
|||
| 166 | temp buffer ([CVE-2026-81738](https://www.cve.org/CVERecord?id=CVE-2026-81738)) |
|||
| 167 | ||||
| 168 | Bug found by Andre Kropp (Nexory) and ChinhNguyen, tracked in Github: |
|||
| 169 | OpenVPN/openvpn-private-issues#165 |
|||
| 170 | ||||
| 171 | - openvpnserv (windows): detect and refuse sibling dirs in |
|||
| 172 | `CheckConfigPath()` ([CVE-2026-81830](https://www.cve.org/CVERecord?id=CVE-2026-81830)) |
|||
| 173 | ||||
| 174 | Bug found by Harshit Varu, tracked in Github: |
|||
| 175 | OpenVPN/openvpn-private-issues#166 |
|||
| 8a81ee | flichtenheld | 2026-07-01 14:35:40 | 176 | |
| 85fa13 | flichtenheld | 2026-10-07 16:15:16 | 177 | Originally there was no Windows installer provided for 2.6.23. But we decided to provide one on October 7 to include the ovpn-dco-win security update. |
| 178 | ||||
| 6a9a91 | flichtenheld | 2026-10-07 16:13:18 | 179 | Windows MSI changes since 2.6.22-I001: |
| 180 | * Update included dco-win driver to v1.3.4 |
|||
| 181 | * [CVE-2026-105390](https://www.cve.org/CVERecord?id=CVE-2026-105390) — a locking flaw allowed a local user with access to the driver's device to cause a system deadlock and denial of service, hanging the host until it was power-cycled. |
|||
| 182 | * Update included OpenSSL to 3.6.5 |
|||
| 183 | ||||
| 4b4a8b | uddr | 2025-06-20 13:43:39 | 184 | | | | | |
| 185 | |-|-|-| |
|||
| 6a9a91 | flichtenheld | 2026-10-07 16:13:18 | 186 | |**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-amd64.msi.asc)|[OpenVPN-2.6.23-I002-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-amd64.msi)| |
| 187 | |**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-arm64.msi.asc)|[OpenVPN-2.6.23-I002-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-arm64.msi)| |
|||
| 188 | |**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-x86.msi.asc)|[OpenVPN-2.6.23-I002-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-x86.msi)| |
|||
| 30bd51 | uddr | 2026-09-23 14:18:40 | 189 | |**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.23.tar.gz.asc)|[openvpn-2.6.23.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.23.tar.gz)| |
| 4b4a8b | uddr | 2025-06-20 13:43:39 | 190 | |
| ecf3c7 | uddr | 2025-11-17 14:47:15 | 191 | #### [Full Release History](https://community.openvpn.net/ReleaseHistory) |