OpenVPN 2.7.4 -- Released 30 April 2026

The OpenVPN community project team is proud to release OpenVPN 2.7.4. This is a small bugfix release.

For details see Changes.rst

Bugfixes:

• using --dns server ... style configs on Windows with win-dco would lead to erroneously enabling "DnsSecValidationRequired : True", possibly breaking VPN DNS resolution. Pushing --dns server ... dnssec no can be used as a workaround until clients can be updated. (Github: openvpn#1024)
• correct comments in the --dns-up-down platform scripts relating to dns_server_..._dnssec values.
• fix release-only build of pkcs11-helper vcpkg port, do not try to install files from debug build.
• mbedTLS builds will now provide a proper error message if a tls-group statement with no valid groups is encountered (used to run into SSL handshake failure later on).
• --enable-strict and --enable-strict-options configure flags have been removed (because they did not actually do anything anymore)

Note: Windows MSI was updated to I002 on June 10th. Changes in I002:

• Included dco-win driver updated to 2.8.3
  • CVE-2026-11604: An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).

For Community-maintained packages for Linux distributions see OpenVPN Software Repositories.

OpenVPN 2.6.20 -- Released 22 April 2026

The OpenVPN community project team is proud to release OpenVPN 2.6.20. This is a bugfix release containing security fixes.

For details see Changes.rst

Security fixes:

• CVE-2026-40215: fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances
• CVE-2026-35058: fix server ASSERT() on receiving a suitably malformed packet with a valid tls-crypt-v2 key

Bugfixes:

• management: stop periodic bytecount output on mgmt client disconnection
• FreeBSD: make DCO work on systems with no IPv4 support
• FreeBSD: fix compilation with --enable-async-push on FreeBSD 15
• Linux: make DCO work on big endian architectures (MIPS, PowerPC)
• Windows: fix deinstallation progress bar on adapter deletion.
• Linux: fix problem with DCO kernel notifications getting lost, leading to overcounting of number of connected clients and general confusion between kernel and userland regarding peer status (Github #900, #918, #931, #919, #945) - this is a backport of the fixes in 2.7 plus the infrastructural changes around DCO needed to support it.

Windows MSI changes since 2.6.19-I001:

• Built against OpenSSL 3.6.2
• Included openvpn-gui updated to 11.63.0.0
  • Translation cleanup. Remove obsolete strings related to support for OpenVPN < 2.0
  • Translation updates.

For Community-maintained packages for Linux distributions see OpenVPN Software Repositories.

Full Release History