Home A - Z
Page Index

An Otter Wiki

Blame

2c3fb4 flichtenheld 2026-10-07 12:29:30 1 
## OpenVPN 2.7.8 -- Released 7 October 2026
2
The OpenVPN community project team is proud to release OpenVPN 2.7.8. This is a bugfix release fixing
3
several security issues.
4
5
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.8/Changes.rst)
6
7
Security fixes:
8
9
- Check for NULL-Bytes in certificate subjects - refuse all such certificates
10
now as "invalid" ([CVE-2026-84790](https://www.cve.org/CVERecord?id=CVE-2026-84790)).
11
12
(Bug reported by Vivek Parikh, tracked in
13
Github: OpenVPN/openvpn-private-issues#163)
14
15
- TLS handshake with tls-crypt-v2: do not try to add a wrapped client key
16
if no key material is available (client bug in response to an ill-behaving
17
server).
18
19
(No CVE assigned as "a malicious server can stop the client from working
20
properly" is not considered a CVE-worthy security issue according to the
21
CRA guidelines)
22
23
- options: fix unsigned underflow when clearing domain_search_list
24
([CVE-2026-88964](https://www.cve.org/CVERecord?id=CVE-2026-84964))
25
26
(Bug reported and fix contributed by Cole Munz,
27
tracked in Github: OpenVPN/openvpn-private-issues#178)
28
29
- win32: stop cmd.exe from expanding variables in quoted arguments
30
([CVE-2026-84256](https://www.cve.org/CVERecord?id=CVE-2026-84256))
31
32
(Bug reported by Darren Carreras, tracked in Github:
33
OpenVPN/openvpn-private-issues#176)
34
35
User-visible Changes:
36
37
- Certificate validation is now stricter regarding NULL bytes in strings
38
(see above). This might break existing installations if such certificates
39
exist and OpenSSL builds are used. mbedTLS builds always rejected this.
40
41
- On a certificate with duplicate fields (multiple CN, for example) OpenSSL
42
builds would use the last one, mbedTLS builds use the first one - changed
43
in the mbedTLS build so behaviour is identical.
44
45
Bugfixes:
46
47
- DCO: remove installed iroutes at client exit time, not at delayed
48
multi instance cleanup time - otherwise there is a race with reconnecting
49
clients, possibly ending up having "no iroutes installed in the system
50
at all". Bug reported by OpenVPN Inc Access Server team.
51
52
- DCO Linux: fix remaining races between synchronous netlink operations
53
and incoming asynchronous notifications, by adding a second netlink socket
54
and strictly separating sync/async operations.
55
56
- Client: refuse incoming pushed option combination of epoch data format
57
with non-AEAD ciphers (restart session instead of aborting with a fatal
58
error).
59
60
- DCO (Linux and Windows): on failures to set up a new peer or install
61
key materials for a peer, do not exit OpenVPN with a fatal error. Instead,
62
signal the error up the call-chain and restart the (multi) instance.
63
64
The handshake is inherently racy when a peer is removed kernel-side
65
due to transport errors or timeouts, and userland does not yet know this
66
and wants to, for example, install new keys. This is fatal for the
67
particular client instance, but must not end the whole server process.
68
69
- DCO: stop fetching peer stats during client disconnect
70
The intention of the original code was to ensure reported counters
71
are always correct, but it did not work (because at query time, the peer
72
in kernel is already gone, so we only got an error message) - and very
73
inefficiently so (because we queried all the peers all the time).
74
End-of-session final counter values will be implemented properly by a
75
followup patch leveraging counters piggybacked on the kernel's
76
"DEL_PEER" notification message.
77
78
- p2mp server: improve handling of mbuf lists in the face of broadcast
79
or multicast traffic, and fix a bug on client exit that could lead
80
to a server queue deadlock in very particular scenarios.
81
82
Windows MSI changes since 2.7.7-I001:
83
* Update included dco-win driver to v2.8.13
84
* [CVE-2026-105390](https://www.cve.org/CVERecord?id=CVE-2026-105390) — a locking flaw allowed a local user with access to the driver's device to cause a system deadlock and denial of service, hanging the host until it was power-cycled.
85
* Performance improvements by moving to multi-core data processing. See [Release Notes](https://github.com/OpenVPN/ovpn-dco-win/releases/tag/2.8.13) for details.
86
* Update included OpenSSL to 3.6.5
707a0d flichtenheld 2026-10-07 15:03:43 87
* Update included Easy-RSA to 3.2.7
2c3fb4 flichtenheld 2026-10-07 12:29:30 88
b17bf7 uddr 2026-10-22 15:52:42 89
Note: Windows MSI was updated to I002 on October 22th. Changes in I002:
90
* Included dco-win driver updated to v2.8.14
91
* ([CVE-2026-115402](https://www.cve.org/CVERecord?id=CVE-2026-115402)) let a
92
TCP connect hold the socket open while its IRP is in flight - a teardown
93
during connect could close a socket WSK was still using, or complete the
94
same request twice, either of which can end in a bug check. Device removal
95
now cancels an in-flight connect instead of waiting for the transport.
96
* fix high CPU usage in System after a session ends - the TX ring was not
97
given back when there was no transport, so the queue stalled and
98
NetAdapterCx kept polling it (Github: [ovpn-dco-win/issues/164](https://github.com/OpenVPN/ovpn-dco-win/issues/164))
99
* socket handling rework - the socket has its own identity and closes on the
100
last reference instead of by draining, and peers transmit over their own
101
socket rather than the device's
102
2c3fb4 flichtenheld 2026-10-07 12:29:30 103
| | | |
104
|-|-|-|
b17bf7 uddr 2026-10-22 15:52:42 105
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-amd64.msi.asc)|[OpenVPN-2.7.8-I002-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-amd64.msi)|
106
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-arm64.msi.asc)|[OpenVPN-2.7.8-I002-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-arm64.msi)|
107
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-x86.msi.asc)|[OpenVPN-2.7.8-I002-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.8-I002-x86.msi)|
2c3fb4 flichtenheld 2026-10-07 12:29:30 108
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.8.tar.gz.asc)|[openvpn-2.7.8.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.8.tar.gz)|
109
110
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
111
ded534 uddr 2026-09-23 14:19:48 112
## OpenVPN 2.6.23 -- Released 23 September 2026
113
The OpenVPN community project team is proud to release OpenVPN 2.6.23. This is a bugfix release fixing
114
several security issues.
115
116
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.23/Changes.rst)
117
118
Security fixes:
119
120
- ssl: do not trust the peer's request to resend the wrapped client key
121
122
Tracked in Github: OpenVPN/openvpn-private-issues#181
123
124
- reliability layer: avoid unbounded reliable TLS timeout, and ignore acks
125
for packets that cannot be outstanding ([CVE-2026-84732](https://www.cve.org/CVERecord?id=CVE-2026-84732))
126
127
Both reliability layer bugs found by Mark Bregman (Fox-IT), tracked in
128
Github: OpenVPN/openvpn-private-issues#161
129
130
- improve on `check_session_buf_not_used()`, catch possible double-free in
131
the lame duck case ([CVE-2026-84471](https://www.cve.org/CVERecord?id=CVE-2026-84471))
132
133
Bug reported by Andreas Gabriel Berbescu, tracked in Github:
134
OpenVPN/openvpn-private-issues#157, and by Haruki Oyama (Waseda
135
University), tracked in OpenVPN/openvpn-private-issues#132
136
137
- windows: fix `CreateProcess()` command line quoting for characters that
138
are special to `cmd.exe`, where a combination of validation script plus
139
rogue CA could lead to misbehavior ([CVE-2026-84256](https://www.cve.org/CVERecord?id=CVE-2026-84256))
140
141
Bug found by Clouditera Security, tracked in Github:
142
OpenVPN/openvpn-private-issues#159
143
144
- windows: fix `tapctl` to always call `netsh.exe` with full path
145
(as we do elsewhere) ([CVE-2026-84226](https://www.cve.org/CVERecord?id=CVE-2026-84226))
146
147
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2), tracked in
148
Github: OpenVPN/openvpn-private-issues#164
149
150
- windows: don't use NULL DACL with system objects, namely the `--service`
151
exit event and the `netsh.exe` guard semaphore. The old approach was
152
prone to a local DoS where one user could interfere with other users'
153
openvpn processes by blocking the netsh semaphore or sending events.
154
This only affects setups not using the iservice, or using the automatic
155
service to start/stop openvpn ([CVE-2026-82312](https://www.cve.org/CVERecord?id=CVE-2026-82312))
156
157
Bug found by DEBRAJ BASAK, tracked in Github:
158
OpenVPN/openvpn-private-issues#167
159
160
- dhcp (windows): fix off-by-one in `write_dhcp_search_str()` temp buffer
161
guard - suitable DHCP options could lead to a single-byte overflow of a
162
temp buffer ([CVE-2026-81738](https://www.cve.org/CVERecord?id=CVE-2026-81738))
163
164
Bug found by Andre Kropp (Nexory) and ChinhNguyen, tracked in Github:
165
OpenVPN/openvpn-private-issues#165
166
167
- openvpnserv (windows): detect and refuse sibling dirs in
168
`CheckConfigPath()` ([CVE-2026-81830](https://www.cve.org/CVERecord?id=CVE-2026-81830))
169
170
Bug found by Harshit Varu, tracked in Github:
171
OpenVPN/openvpn-private-issues#166
172
0966d2 flichtenheld 2026-10-07 16:17:17 173
Originally there was no Windows installer provided for 2.6.23. But we decided to provide one on October 7 to include the ovpn-dco-win security update.
174
175
Windows MSI changes since 2.6.22-I001:
176
* Update included dco-win driver to v1.3.4
177
* [CVE-2026-105390](https://www.cve.org/CVERecord?id=CVE-2026-105390) — a locking flaw allowed a local user with access to the driver's device to cause a system deadlock and denial of service, hanging the host until it was power-cycled.
178
* Update included OpenSSL to 3.6.5
179
ded534 uddr 2026-09-23 14:19:48 180
| | | |
181
|-|-|-|
0966d2 flichtenheld 2026-10-07 16:17:17 182
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-amd64.msi.asc)|[OpenVPN-2.6.23-I002-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-amd64.msi)|
183
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-arm64.msi.asc)|[OpenVPN-2.6.23-I002-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-arm64.msi)|
184
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-x86.msi.asc)|[OpenVPN-2.6.23-I002-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.23-I002-x86.msi)|
ded534 uddr 2026-09-23 14:19:48 185
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.23.tar.gz.asc)|[openvpn-2.6.23.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.23.tar.gz)|
186
c19644 uddr 2026-09-03 14:34:10 187
## OpenVPN 2.7.7 -- Released 3 September 2026
188
The OpenVPN community project team is proud to release OpenVPN 2.7.7. This is a bugfix release fixing
189
many security issues.
190
191
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.7/Changes.rst)
192
193
Security fixes:
194
f61b09 flichtenheld 2026-10-18 07:20:26 195
- Improve on check_session_buf_not_used(), catch possible double-free in
196
the lame duck case ([CVE-2026-84471](https://www.cve.org/CVERecord?id=CVE-2026-84471)).
197
198
(Bug reported by Andreas Gabriel Berbescu,
199
tracked in Github: openvpn/openvpn-private-issues#157, and by
200
Haruki Oyama (Waseda University), tracked in private-issues#132)
201
c19644 uddr 2026-09-03 14:34:10 202
- reliability layer: avoid unbounded reliable TLS timeout, and ignore acks
203
for packets that cannot be outstanding ([CVE-2026-84732](https://www.cve.org/CVERecord?id=CVE-2026-84732))
204
205
Both reliability layer bugs found by Mark Bregman (Fox-IT), tracked in
206
Github: OpenVPN/openvpn-private-issues#161
207
208
- windows: fix `CreateProcess()` command line quoting for characters that
209
are special to `cmd.exe`, where a combination of validation script plus
210
rogue CA could lead to misbehavior ([CVE-2026-84256](https://www.cve.org/CVERecord?id=CVE-2026-84256))
211
212
Bug found by Clouditera Security, tracked in Github:
213
OpenVPN/openvpn-private-issues#159
214
215
- windows: fix `tapctl` to always call `netsh.exe` with full path
216
(as we do elsewhere) ([CVE-2026-84226](https://www.cve.org/CVERecord?id=CVE-2026-84226))
217
218
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2), tracked in
219
Github: OpenVPN/openvpn-private-issues#164
220
221
- windows: don't use NULL DACL with system objects, namely the `--service`
222
exit event and the `netsh.exe` guard semaphore. The old approach was
223
prone to a local DoS where one user could interfere with other users'
224
openvpn processes by blocking the netsh semaphore or sending events.
225
This only affects setups not using the iservice, or using the automatic
226
service to start/stop openvpn ([CVE-2026-82312](https://www.cve.org/CVERecord?id=CVE-2026-82312))
227
228
Bug found by DEBRAJ BASAK, tracked in Github:
229
OpenVPN/openvpn-private-issues#167
230
231
- openvpnserv (windows): pass correct NRPT domains size - when IDN domains
232
with UTF8 encoding were involved, a buffer overread could be achieved
233
([CVE-2026-78221](https://www.cve.org/CVERecord?id=CVE-2026-78221))
234
235
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2), in Github:
236
OpenVPN/openvpn-private-issues#162
237
238
- openvpnserv (windows): don't allow '/' in config paths. The APIs windows
239
uses for path validation do not handle '/' as path separator, while the
240
file open APIs do, so this could be used to circumvent our config path
241
validation, leading to openvpn.exe starting a user-controlled config file
242
even if administratively not allowed ([CVE-2026-78043](https://www.cve.org/CVERecord?id=CVE-2026-78043))
243
244
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2), in Github:
245
OpenVPN/openvpn-private-issues#162
246
247
- dhcp (windows): fix off-by-one in `write_dhcp_search_str()` temp buffer
248
guard - suitable DHCP options could lead to a single-byte overflow of a
249
temp buffer ([CVE-2026-81738](https://www.cve.org/CVERecord?id=CVE-2026-81738))
250
251
Bug found by Andre Kropp (Nexory) and ChinhNguyen, tracked in Github:
252
OpenVPN/openvpn-private-issues#165
253
254
- linux netlink: validate netlink replies against the request
255
256
Suggested by Joshua Rogers as a security improvement, tracked in Github:
257
OpenVPN/openvpn-private-issues#9
258
259
- openvpnserv (windows): fix off-by-one on input validation
260
(discovered while fixing CVE-2026-78221)
261
262
- openvpnserv (windows): harden `CheckConfigPath()` a bit more
263
(another improvement while working on CVE-2026-78043)
264
265
User-visible Changes:
266
267
- when using EPOCH data channel format, reduce the number of future keys
268
from 16 to 4 - the previous calculation was wrong, and 4 spare keys are
269
sufficient for 100+ Gbit/s links. This means less log spam in userland
270
and fewer resources used in in-kernel implementations.
271
272
Bugfixes:
273
274
- work around a pubkey-handling bug in mbedTLS 4.1.0 and 4.2.0
275
(supposedly fixed in 4.3.0)
276
277
- multi: don't let stale-routes-check delete permanent routes -
278
`--stale-routes-check` did not only delete dynamic cached routes, but
279
also routes installed by `--iroute` and `--ifconfig-push`. Fixed by
280
introducing route flags and restraining the check on them
281
(Github: [OpenVPN/openvpn#1063](https://github.com/OpenVPN/openvpn/issues/1063))
282
283
- ssl: do not queue control ciphertext while a packet is still queued
284
(fixes problems in TCP p2p handshake when both sides try to handshake
285
at the same time)
286
(Github: [OpenVPN/openvpn#1089](https://github.com/OpenVPN/openvpn/issues/1089))
287
288
- reenable xmit_hold when using p2p tcp-server and tls-server - in TCP
289
server mode the server is not expected to initiate the TLS handshake.
290
This was introduced by the multisocket code checking the wrong variable
291
for socket protocol
292
(Github: [OpenVPN/openvpn#1089](https://github.com/OpenVPN/openvpn/issues/1089))
293
294
- clinat: do not adjust UDP checksum if zero (as per RFC768)
295
(Github: [OpenVPN/openvpn#1037](https://github.com/OpenVPN/openvpn/issues/1037))
296
297
- openssl: avoid resetting the HMAC key on every packet
298
(Github: [OpenVPN/openvpn#1088](https://github.com/OpenVPN/openvpn/issues/1088))
299
300
- openvpnserv (windows): fix log lines format string - interface names with
301
international characters printed in some error messages need to be
302
converted from UTF8 to UCS16 first.
303
304
- fix format string specifier for size_t (%zu)
305
306
- fix test_misc compile issues with -Werror
307
308
Windows MSI changes since 2.7.6-I001:
309
* Update included dco-win driver to v2.8.7
88dbb7 uddr 2026-09-07 09:56:01 310
* peer: fix use-after-free in multipeer peer table handling (Github: [OpenVPN/ovpn-dco-win#140](https://github.com/OpenVPN/ovpn-dco-win/pull/140))([CVE-2026-82325](https://www.cve.org/CVERecord?id=CVE-2026-82325))
311
* inf: set the device security descriptor in the hardware key (Github: [OpenVPN/ovpn-dco-win#139](https://github.com/OpenVPN/ovpn-dco-win/pull/139))
c19644 uddr 2026-09-03 14:34:10 312
313
| | | |
314
|-|-|-|
315
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.7-I001-amd64.msi.asc)|[OpenVPN-2.7.7-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.7-I001-amd64.msi)|
316
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.7-I001-arm64.msi.asc)|[OpenVPN-2.7.7-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.7-I001-arm64.msi)|
317
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.7-I001-x86.msi.asc)|[OpenVPN-2.7.7-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.7-I001-x86.msi)|
318
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.7.tar.gz.asc)|[openvpn-2.7.7.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.7.tar.gz)|
319
320
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
321
05fd00 flichtenheld 2026-08-05 19:38:48 322
## OpenVPN 2.7.6 -- Released 5 August 2026
323
The OpenVPN community project team is proud to release OpenVPN 2.7.6. This is a bugfix release fixing
324
several security issues.
325
326
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.6/Changes.rst)
327
328
Security fixes:
329
330
- openvpnserv (windows): better scrutinize command line passed in
331
from the control socket to openvpn. This would lead to circumventing
332
admin restrictions on allowed openvpn config directories (but never
333
to "read files the user has no permissions for") ([CVE-2026-63649](https://www.cve.org/CVERecord?id=CVE-2026-63649))
334
335
Bug found by 章鱼哥 (www.aipyaipy.com)
336
337
- dco: make key state desync recoverable
338
339
This was reported as a "with suitable timing, a key-update de-sync between
340
OpenVPN and the kernel could trigger an ASSERT()", and was initially
341
handled as security report. It turned out to be not exploitable, but the
342
state machine was not very robust and so the opportunity was used to
343
improve the code.
344
345
Bug found by 章鱼哥 (www.aipyaipy.com)
346
347
- make ``--x509-username-field`` work with mbedTLS.
348
349
In very particular setups, together with a CA creating matching certificates,
350
this could lead to unintentionally permitting a certificate that should
351
not have. This is why this was considered a (low-prio) security bug and a
352
CVE ID was assigned ([CVE-2026-63650](https://www.cve.org/CVERecord?id=CVE-2026-63650))
353
354
Bug found by 章鱼哥 (www.aipyaipy.com)
355
356
User-visible Changes:
357
358
- if `--dev` is not specified, default to `--dev tun` - so for the
359
tun case, this option can now be left out of the openvpn config.
360
361
- `--ping` and `--keepalive` settings are now limited to 24 hours
362
maximum - the primary reason for that is to avoid lots of extra code
363
in the DCO kernel to handle arbitrarily large values without overflowing
364
32 bit integers. 24h is considered much higher than any reasonable use.
365
366
- The `TCP_NODELAY` socket flag is now "always on". The `--tcp-nodelay`
367
option is kept, because setting it on a p2mp server also enables pushing
368
of `socket-flags TCP_NODELAY` to clients, which might not have this
369
code change yet.
370
371
- Remove `--providers` from `--help` output on mbedTLS builds.
372
373
Bugfixes:
374
375
- refuse incoming HARD RESET packets with a sequence ID != 0
376
(this is basically making an OpenVPN server ignore and log a
377
"should never happen" client-side misbehaviour, which could lead to
378
TLS handshake establishment failures in p2p TLS setups)
379
380
- correctly calculate packet id size if epoch packet format is in use -
381
this was off by 4, for connections openvpn 2.7+ to openvpn 2.7+,
382
exceeding "mssfix mtu" headroom by those 4 bytes
383
(Github: [OpenVPN/openvpn#1074](https://github.com/OpenVPN/openvpn/issues/1074))
384
385
- correct minimum packet length check for 802.1q tagged packets
386
(Github: [OpenVPN/openvpn#1044](https://github.com/OpenVPN/openvpn/issues/1044)).
387
388
This was also reported (twice) as a security bug, as technically
389
OpenVPN with `--client-nat` would read and write up to 4 bytes
390
"after the end of the packet" - but due to the OpenVPN packet buffer
391
layouts, which are always full-frame-sized this is fully safe and has
392
no adverse consequences.
393
394
395
Windows MSI changes since 2.7.5-I001:
396
* Update included dco-win driver to v2.8.4
397
* fix control channel stall (Github: [ovpn-dco-win/issues/137](https://github.com/OpenVPN/ovpn-dco-win/issues/137))
398
399
| | | |
400
|-|-|-|
401
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-amd64.msi.asc)|[OpenVPN-2.7.6-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-amd64.msi)|
402
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-arm64.msi.asc)|[OpenVPN-2.7.6-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-arm64.msi)|
403
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-x86.msi.asc)|[OpenVPN-2.7.6-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.6-I001-x86.msi)|
404
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.6.tar.gz.asc)|[openvpn-2.7.6.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.6.tar.gz)|
405
406
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
407
408
## OpenVPN 2.6.22 -- Released 5 August 2026
409
The OpenVPN community project team is proud to release OpenVPN 2.6.22. This is a bugfix release fixing
410
several security issues.
411
412
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.22/Changes.rst)
413
414
Security fixes:
415
416
- openvpnserv (windows): better scrutinize command line passed in
417
from the control socket to openvpn. This would lead to circumventing
418
admin restrictions on allowed openvpn config directories (but never
419
to "read files the user has no permissions for") ([CVE-2026-63649](https://www.cve.org/CVERecord?id=CVE-2026-63649))
420
421
Bug found by 章鱼哥 (www.aipyaipy.com)
422
423
- dco: make key state desync recoverable
424
425
This was reported as a "with suitable timing, a key-update de-sync between
426
OpenVPN and the kernel could trigger an ASSERT()", and was initially
427
handled as security report. It turned out to be not exploitable, but the
428
state machine was not very robust and so the opportunity was used to
429
improve the code.
430
431
Bug found by 章鱼哥 (www.aipyaipy.com)
432
433
Bugfixes:
434
435
- refuse incoming HARD RESET packets with a sequence ID != 0
436
(this is basically making an OpenVPN server ignore and log a
437
"should never happen" client-side misbehaviour, which could lead to
438
TLS handshake establishment failures in p2p TLS setups)
439
440
- correct minimum packet length check for 802.1q tagged packets
441
(Github: [OpenVPN/openvpn#1044](https://github.com/OpenVPN/openvpn/issues/1044)).
442
443
This was also reported (twice) as a security bug, as technically
444
OpenVPN with `--client-nat` would read and write up to 4 bytes
445
"after the end of the packet" - but due to the OpenVPN packet buffer
446
layouts, which are always full-frame-sized this is fully safe and has
447
no adverse consequences.
448
449
450
| | | |
451
|-|-|-|
452
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-amd64.msi.asc)|[OpenVPN-2.6.22-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-amd64.msi)|
453
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-arm64.msi.asc)|[OpenVPN-2.6.22-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-arm64.msi)|
454
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-x86.msi.asc)|[OpenVPN-2.6.22-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.22-I001-x86.msi)|
455
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.22.tar.gz.asc)|[openvpn-2.6.22.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.22.tar.gz)|
456
457
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
1353e7 flichtenheld 2026-07-01 14:43:01 458
## OpenVPN 2.6.21 -- Released 1 July 2026
459
The OpenVPN community project team is proud to release OpenVPN 2.6.21. This is a bugfix release fixing
460
several security issues.
461
462
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.21/Changes.rst)
463
464
Security fixes:
465
466
- Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed
467
sequence of control channel + authentication packets ([CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996))
468
469
Bug found by multiple researchers:
470
- 章鱼哥 (www.aipyaipy.com)
471
- Haiyang Huang
472
- Haruki Oyama (Waseda University)
473
474
- Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable
475
sequence of dynamic tls-crypt control-channel packets ([CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117))
476
477
Bug found by multiple researchers:
478
- Trace37 Labs (github.com/trace37labs)
479
- Haiyang Huang
480
481
- Fix server crash on reception of suitably malformed auth-token, if
482
`--auth-gen-token external-auth` is active ([CVE-2026-13122](https://www.cve.org/CVERecord?id=CVE-2026-13122))
483
484
Bug found by Haiyang Huang.
485
486
- Fix memory-leak in tls-crypt-v2 client key handling that could lead
487
to out-of-memory situations and subsequent server crashes ([CVE-2026-12932](https://www.cve.org/CVERecord?id=CVE-2026-12932))
488
489
Bug found by Valton Tahiri.
490
491
- Fix possible 1-byte buffer overrun on NTLMv2 proxy responses.
492
([CVE-2026-11771](https://www.cve.org/CVERecord?id=CVE-2026-11771))
493
494
Bug found by Tristan Madani (@TristanInSec).
495
496
- Fix another memory leak on reception of suitable tls-crypt-v2 packets
497
that could lead to an out of memory situation and server crash
498
([CVE-2026-13698](https://www.cve.org/CVERecord?id=CVE-2026-13698))
499
500
Bug found by Max Fillinger. Overlaps with a report
501
from Valton Tahiri that we believe to
502
be fixed by this bugfix as well.
503
1be8a9 flichtenheld 2026-07-01 14:43:50 504
Bugfixes:
505
1353e7 flichtenheld 2026-07-01 14:43:01 506
- Windows: fix plugin trusted-dir check prefix bypass
507
(this fixes a bug in the path checking logic we do on Windows for
508
"is loading a plugin from this path allowed?", but since we could
509
not find a way to exploit this unless starting with admin privs or
510
a social engineering attack, not classified as a security fix)
511
512
- options: fix use-after-free of DNS options on client connect
513
(using suitable `--dns` or `--dhcp-option DNS` options in a server
514
config - not pushed, but applying to the server itself - triggers a
515
double free() and use-after-free condition, possibly crashing the
516
server) (Github: [OpenVPN/openvpn#1060](https://github.com/OpenVPN/openvpn/issues/1060))
517
518
- Null-terminate tls-crypt client keys when testing - non-exploitable
519
strlen() on a buffer that is not null-terminated
520
521
- Ensure pushed tun-mtu is no lower than TUN_MTU_MIN - this fixes a bug
522
where a server can push a suitable combination of options and make the
523
client ASSERT().
524
525
(Reported as security issue by Haiyang Huang,
526
but it was decided that the server always has means to make the client
527
"not function properly", and it can not be exploited beyond that)
528
529
Windows MSI changes since 2.6.20-I001:
530
* Built against OpenSSL 3.6.3
531
532
| | | |
533
|-|-|-|
534
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-amd64.msi.asc)|[OpenVPN-2.6.21-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-amd64.msi)|
535
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-arm64.msi.asc)|[OpenVPN-2.6.21-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-arm64.msi)|
05fd00 flichtenheld 2026-08-05 19:38:48 536
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-x86.msi.asc)|[OpenVPN-2.6.21-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.21-I001-x86.msi)|
1353e7 flichtenheld 2026-07-01 14:43:01 537
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.21.tar.gz.asc)|[openvpn-2.6.21.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.21.tar.gz)|
538
539
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
540
c6c36a flichtenheld 2026-07-01 13:49:39 541
## OpenVPN 2.7.5 -- Released 1 July 2026
542
The OpenVPN community project team is proud to release OpenVPN 2.7.5. This is a bugfix release fixing
543
several security issues.
544
545
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst)
546
547
Security fixes:
548
549
- openvpnserv (windows): fix DNS SearchList state pollution on (dis)connect.
550
specific combinations of `--dns` config entries plus local DNS config
551
could lead to corruption of pre-openvpn DNS config ([CVE-2026-13379](https://www.cve.org/CVERecord?id=CVE-2026-13379))
552
553
Bug found by 章鱼哥 (www.aipyaipy.com).
554
555
- Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed
556
sequence of control channel + authentication packets ([CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996))
557
558
Bug found by multiple researchers:
559
- 章鱼哥 (www.aipyaipy.com)
560
- Haiyang Huang
561
- Haruki Oyama (Waseda University)
562
563
- Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable
564
sequence of dynamic tls-crypt control-channel packets ([CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117))
565
566
Bug found by multiple researchers:
567
- Trace37 Labs (github.com/trace37labs)
568
- Haiyang Huang
569
570
- Fix server crash on reception of suitably malformed auth-token, if
571
`--auth-gen-token external-auth` is active ([CVE-2026-13122](https://www.cve.org/CVERecord?id=CVE-2026-13122))
572
573
Bug found by Haiyang Huang.
574
575
- Fix memory-leak in tls-crypt-v2 client key handling that could lead
576
to out-of-memory situations and subsequent server crashes ([CVE-2026-12932](https://www.cve.org/CVERecord?id=CVE-2026-12932))
577
578
Bug found by Valton Tahiri.
579
580
- Fix possible 1-byte buffer overrun on NTLMv2 proxy responses.
581
([CVE-2026-11771](https://www.cve.org/CVERecord?id=CVE-2026-11771))
582
583
Bug found by Tristan Madani (@TristanInSec).
584
585
- Fix another memory leak on reception of suitable tls-crypt-v2 packets
586
that could lead to an out of memory situation and server crash
587
([CVE-2026-13698](https://www.cve.org/CVERecord?id=CVE-2026-13698))
588
589
Bug found by Max Fillinger. Overlaps with a report
590
from Valton Tahiri that we believe to
591
be fixed by this bugfix as well.
592
1be8a9 flichtenheld 2026-07-01 14:43:50 593
Bugfixes:
594
c6c36a flichtenheld 2026-07-01 13:49:39 595
- Windows: fix plugin trusted-dir check prefix bypass
596
(this fixes a bug in the path checking logic we do on Windows for
597
"is loading a plugin from this path allowed?", but since we could
598
not find a way to exploit this unless starting with admin privs or
599
a social engineering attack, not classified as a security fix)
600
601
- Windows: openvpnserv: rework ConvertItfDnsDomains and tests
602
(this fixes a buffer overread that is not exploitable and as such
603
not classified as security fix)
604
605
- options: fix use-after-free of DNS options on client connect
606
(using suitable `--dns` or `--dhcp-option DNS` options in a server
607
config - not pushed, but applying to the server itself - triggers a
608
double free() and use-after-free condition, possibly crashing the
609
server) (Github: [OpenVPN/openvpn#1060](https://github.com/OpenVPN/openvpn/issues/1060))
610
611
- dns: Fix memory leak in dns_server_addr_parse, if too many server
612
addresses are configured (Github: [OpenVPN/openvpn#1055](https://github.com/OpenVPN/openvpn/issues/1055))
613
614
- improve multi-socket event handling further - multiple open UDP sockets
615
with concurrent traffic could lead to inefficient processing, and the
616
old code was also very hard to follow.
617
618
(This was initially triggered by a report from Joshua Rogers using ZeroPath,
619
but turned out to be "just bad code" not a security vulnerability)
620
621
- Null-terminate tls-crypt client keys when testing - non-exploitable
622
strlen() on a buffer that is not null-terminated
623
624
- mudp: send HMAC reset reply synchronously
625
this fixes a bug where multiple incoming tls-crypt-v2 RESET packets
626
on different sockets could end up overwriting each other's control
627
structures, leading to initial handshake packets (HMAC reset reply)
628
being sent to the wrong client IP, or on a non-suitable socket
629
("v4 packet on a v6 socket"). Since the overall flow here is stateless
630
by nature, do not artificially create state by creating elaborate
631
queues, just send-or-drop.
632
633
- fix port-share and multi-socket interaction - port-share needs TCP
634
listeners, but the check was wrong. So "as long as any of the listening
635
sockets is TCP, port-share can be used" (Github: [OpenVPN/openvpn#1027](https://github.com/OpenVPN/openvpn/issues/1027))
636
637
- Ensure pushed tun-mtu is no lower than TUN_MTU_MIN - this fixes a bug
638
where a server can push a suitable combination of options and make the
639
client ASSERT().
640
641
(Reported as security issue by Haiyang Huang,
642
but it was decided that the server always has means to make the client
643
"not function properly", and it can not be exploited beyond that)
644
645
- Windows: socket: assert buffer length before reading prepended sockaddr
646
family - a misbehaviour in the windows DCO driver could trigger an
647
overread in the userland client. No such bug exists, which this was
648
not treated as a security vulnerability
649
1be8a9 flichtenheld 2026-07-01 14:43:50 650
Documentation improvements:
651
c6c36a flichtenheld 2026-07-01 13:49:39 652
- improve documentation for `--float` (Github: [OpenVPN/openvpn#358](https://github.com/OpenVPN/openvpn/issues/358))
653
- add documentation for `--preresolve` (Github: [OpenVPN/openvpn#532](https://github.com/OpenVPN/openvpn/issues/532))
654
- impove documentation around DNS config (Github: [OpenVPN/openvpn#937](https://github.com/OpenVPN/openvpn/issues/937))
655
656
Windows MSI changes since 2.7.4-I002:
657
* Built against OpenSSL 3.6.3
658
659
| | | |
660
|-|-|-|
661
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-amd64.msi.asc)|[OpenVPN-2.7.5-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-amd64.msi)|
662
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-arm64.msi.asc)|[OpenVPN-2.7.5-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-arm64.msi)|
663
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-x86.msi.asc)|[OpenVPN-2.7.5-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.5-I001-x86.msi)|
664
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.5.tar.gz.asc)|[openvpn-2.7.5.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.5.tar.gz)|
665
666
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
667
02ae13 flichtenheld 2026-04-30 20:02:29 668
## OpenVPN 2.7.4 -- Released 30 April 2026
669
The OpenVPN community project team is proud to release OpenVPN 2.7.4. This is a small bugfix release.
670
671
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.4/Changes.rst)
672
673
Bugfixes:
674
675
- using `--dns server ...` style configs on Windows with win-dco would
676
lead to erroneously enabling "DnsSecValidationRequired : True", possibly
677
breaking VPN DNS resolution. Pushing `--dns server ... dnssec no`
678
can be used as a workaround until clients can be updated.
679
(Github: [openvpn#1024](https://github.com/OpenVPN/openvpn/issues/1024))
680
- correct comments in the `--dns-up-down` platform scripts relating to
681
`dns_server_..._dnssec` values.
682
- fix release-only build of pkcs11-helper vcpkg port, do not try to
683
install files from debug build.
684
- mbedTLS builds will now provide a proper error message if a
685
`tls-group` statement with no valid groups is encountered
686
(used to run into SSL handshake failure later on).
687
- `--enable-strict` and `--enable-strict-options` configure flags have
688
been removed (because they did not actually do anything anymore)
689
1213fa flichtenheld 2026-06-10 16:44:15 690
Note: Windows MSI was updated to I002 on June 10th. Changes in I002:
691
692
* Included dco-win driver updated to 2.8.3
693
* [CVE-2026-11604](https://www.cve.org/CVERecord?id=CVE-2026-11604): An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win
694
allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash
695
(denial of service).
696
02ae13 flichtenheld 2026-04-30 20:02:29 697
| | | |
698
|-|-|-|
1213fa flichtenheld 2026-06-10 16:44:15 699
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.4-I002-amd64.msi.asc)|[OpenVPN-2.7.4-I002-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.4-I002-amd64.msi)|
700
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.4-I002-arm64.msi.asc)|[OpenVPN-2.7.4-I002-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.4-I002-arm64.msi)|
701
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.4-I002-x86.msi.asc)|[OpenVPN-2.7.4-I002-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.4-I002-x86.msi)|
02ae13 flichtenheld 2026-04-30 20:02:29 702
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.4.tar.gz.asc)|[openvpn-2.7.4.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.4.tar.gz)|
703
704
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
705
c15d53 uddr 2026-04-27 15:21:55 706
## OpenVPN 2.7.3 -- Released 27 April 2026
707
The OpenVPN community project team is proud to release OpenVPN 2.7.3. This is a small bugfix release.
708
709
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.3/Changes.rst)
710
711
Bugfixes:
712
713
* in combination with ``--management-query-passwords``, setups using
714
``--auth-user-pass file`` or inline ``auth-user-pass`` would no longer
715
use the configured passwords and prompt on the management interface
716
instead (OpenVPN GUI would then provide an empty user/password prompt)
717
(Github: [openpvn#1021](https://github.com/OpenVPN/openvpn/issues/1021)).
718
719
| | | |
720
|-|-|-|
721
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.3-I001-amd64.msi.asc)|[OpenVPN-2.7.3-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.3-I001-amd64.msi)|
722
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.3-I001-arm64.msi.asc)|[OpenVPN-2.7.3-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.3-I001-arm64.msi)|
723
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.3-I001-x86.msi.asc)|[OpenVPN-2.7.3-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.3-I001-x86.msi)|
724
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.3.tar.gz.asc)|[openvpn-2.7.3.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.3.tar.gz)|
725
726
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
727
dab7ff uddr 2026-04-22 14:57:20 728
## OpenVPN 2.7.2 -- Released 22 April 2026
729
The OpenVPN community project team is proud to release OpenVPN 2.7.2. This is a bugfix release containing security fixes.
730
731
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.2/Changes.rst)
732
733
Security fixes:
734
735
* [CVE-2026-40215](https://www.cve.org/CVERecord?id=CVE-2026-40215): fix race condition in TLS handshake that could lead to leaking of
736
packet data from a previous handshake under specific circumstances
737
* [CVE-2026-35058](https://www.cve.org/CVERecord?id=CVE-2026-35058): fix server ASSERT() on receiving a suitably malformed packet with
738
a valid tls-crypt-v2 key
739
740
New features:
741
742
* management interface: permit input of very long passwords in
743
base64-encoded multiline format. Signal support to management
744
clients via "management version 6".
745
746
User-visible Changes:
747
748
* improve error messages on ``--verify-x509-name`` failures
749
* improve error logging when overlong username or passwords can not
750
be written to TLS buffer
751
752
Bugfixes:
753
754
* when using a config file with inlined username and no password,
755
fix prompting for the password from management interface.
756
* Windows: fix DNSSEC flag handling - this got never applied due to
757
a bad comparison being always false.
758
* Windows: fix deinstallation progress bar on adapter deletion.
759
760
Windows MSI changes since 2.7.1:
761
* Built against OpenSSL 3.6.2
762
* Included openvpn-gui updated to 11.63.0.0
763
* Translation cleanup. Remove obsolete strings related to support for OpenVPN < 2.0
764
* Translation updates.
765
766
| | | |
767
|-|-|-|
768
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.2-I001-amd64.msi.asc)|[OpenVPN-2.7.2-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.2-I001-amd64.msi)|
769
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.2-I001-arm64.msi.asc)|[OpenVPN-2.7.2-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.2-I001-arm64.msi)|
770
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.2-I001-x86.msi.asc)|[OpenVPN-2.7.2-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.2-I001-x86.msi)|
771
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.2.tar.gz.asc)|[openvpn-2.7.2.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.2.tar.gz)|
772
773
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
774
775
## OpenVPN 2.6.20 -- Released 22 April 2026
776
The OpenVPN community project team is proud to release OpenVPN 2.6.20. This is a bugfix release containing security fixes.
777
778
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.20/Changes.rst)
779
780
Security fixes:
781
782
* [CVE-2026-40215](https://www.cve.org/CVERecord?id=CVE-2026-40215): fix race condition in TLS handshake that could lead to leaking of
783
packet data from a previous handshake under specific circumstances
784
* [CVE-2026-35058](https://www.cve.org/CVERecord?id=CVE-2026-35058): fix server ASSERT() on receiving a suitably malformed packet with
785
a valid tls-crypt-v2 key
786
787
Bugfixes:
788
789
* management: stop periodic bytecount output on mgmt client disconnection
790
* FreeBSD: make DCO work on systems with no IPv4 support
791
* FreeBSD: fix compilation with --enable-async-push on FreeBSD 15
792
* Linux: make DCO work on big endian architectures (MIPS, PowerPC)
793
* Windows: fix deinstallation progress bar on adapter deletion.
794
* Linux: fix problem with DCO kernel notifications getting lost, leading
795
to overcounting of number of connected clients and general confusion
796
between kernel and userland regarding peer status (Github [#900](https://github.com/OpenVPN/openvpn/issues/900), [#918](https://github.com/OpenVPN/openvpn/issues/918),
797
[#931](https://github.com/OpenVPN/openvpn/issues/931), [#919](https://github.com/OpenVPN/openvpn/issues/919), [#945](https://github.com/OpenVPN/openvpn/issues/945)) - this is a backport of the fixes in 2.7 plus the
798
infrastructural changes around DCO needed to support it.
799
800
Windows MSI changes since 2.6.19-I001:
801
* Built against OpenSSL 3.6.2
802
* Included openvpn-gui updated to 11.63.0.0
803
* Translation cleanup. Remove obsolete strings related to support for OpenVPN < 2.0
804
* Translation updates.
805
806
| | | |
807
|-|-|-|
808
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-amd64.msi.asc)|[OpenVPN-2.6.20-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-amd64.msi)|
809
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-arm64.msi.asc)|[OpenVPN-2.6.20-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-arm64.msi)|
810
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-x86.msi.asc)|[OpenVPN-2.6.20-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.20-I001-x86.msi)|
811
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.20.tar.gz.asc)|[openvpn-2.6.20.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.20.tar.gz)|
812
feaea5 uddr 2026-04-22 14:59:21 813
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
814
8ec6a8 flichtenheld 2026-03-31 15:56:48 815
## OpenVPN 2.7.1 -- Released 31 March 2026
816
The OpenVPN community project team is proud to release OpenVPN 2.7.1. This is a bug fix release.
817
818
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.1/Changes.rst)
819
820
New features:
821
822
- Add a new `username-only` flag argument to `--auth-user-pass` which
823
will now make OpenVPN only query for username and send a dummy password
824
to the server. This is only useful if auth schemes are used on the
825
server side that will do some sort of external challenge base on username,
826
and not password authentication. See discussion in
827
GH [OpenVPN/openvpn#501](https://github.com/OpenVPN/openvpn/issues/501)
828
(starting Jan 30, 2024).
829
- Increase default sizing of internal hash maps to `4 * --max-clients`.
830
The default used to be `256` with a `--max-clients` default of
831
1024 - this is bad for performance, while the memory savings are
832
minimal. On a very memory constrained system, reduce `--max-clients`.
833
834
User-visible Changes:
835
836
- When compiled with the AWS-LC SSL library, using `--tls-cert-profile`
837
will now print a run-time warning - the library does not support it,
838
so it would silently do nothing.
839
- Systemd unit files: change LimitNPROC to TasksMax and increase limit
840
(GH: [OpenVPN/openvpn#929](https://github.com/OpenVPN/openvpn/issues/929))
841
- Documentation improvements.
842
- port-share: log incoming connections at `verb 3`, not on `error`
843
level anymore (GH: [OpenVPN/openvpn#976](https://github.com/OpenVPN/openvpn/issues/976)).
844
845
Bugfixes:
846
847
- Fix usage of `--lport` inside a `<connection>` block - this got
848
broken with the multi-socket patchset (GH: [OpenVPN/openvpn#995](https://github.com/OpenVPN/openvpn/issues/995))
849
- Do not try to run auto-pam unit test when cross-compiling.
850
- Do not break private-key passphrases of length >= 64
851
(GH: [OpenVPN/openvpn#993](https://github.com/OpenVPN/openvpn/issues/993))
852
- Fix obscure ASSERT() crash on TCP connects with TAP and no ip config.
853
- Make DCO work on FreeBSD systems that have no IPv4 support in kernel
854
(FreeBSD PR 286263)
855
- Make DCO work on Linux on big endian systems (namely, MIPS and PowerPC)
856
(GH: [OpenVPN/ovpn-dco#96](https://github.com/OpenVPN/ovpn-dco/issues/96))
857
- Fixup responses to management interface ``version`` command (for >= 4)
858
- Make `--enable-async-push` work on FreeBSD 15 (which has native
859
inotify support, and consequently no libinotify.pc anymore)
860
- Adjust some code parts to new "const" handling on string function
861
returns (ISO C23, as implemented by glibc 2.43 and newer).
862
863
Windows MSI changes since 2.7.1:
864
* Make sure that included openvpnserv2.exe is signed (GH: [OpenVPN/openvpn-build#1293](https://github.com/OpenVPN/openvpn-build/issues/1293))
865
* Included openvpn-gui updated to 11.62.0.0
866
* Translation updates
867
868
| | | |
869
|-|-|-|
870
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.1-I001-amd64.msi.asc)|[OpenVPN-2.7.1-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.1-I001-amd64.msi)|
871
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.1-I001-arm64.msi.asc)|[OpenVPN-2.7.1-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.1-I001-arm64.msi)|
872
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.1-I001-x86.msi.asc)|[OpenVPN-2.7.1-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.1-I001-x86.msi)|
873
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.1.tar.gz.asc)|[openvpn-2.7.1.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.1.tar.gz)|
874
875
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
876
586cd5 flichtenheld 2026-02-11 12:56:28 877
## OpenVPN 2.7.0 -- Released 11 February 2026
878
The OpenVPN community project team is proud to release OpenVPN 2.7.0.
879
This is the new stable version of OpenVPN with some major new features.
880
881
This release has only minor changes relative to the last release candidate release 2.7_rc6.
882
For a list of these changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_rc6...v2.7.0).
883
884
Highlights of 2.7 include:
885
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
886
* Improved Client support for DNS options
887
* Client implementations for Linux/BSD/macOS, included with the default install
888
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
889
* Architectural improvements on Windows
890
* The `block-local` flag is now enforced with WFP filters
891
* Windows network adapters are now generated on demand
892
* Windows automatic service now runs as an unpriviledged user
893
* Support for server mode in win-dco driver
894
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
895
* Improved data channel
896
* Enforcement of AES-GCM usage limit
897
* Epoch data keys and packet format
898
* Support for new upstream DCO Linux kernel module
899
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
900
* Client-side support for new `PUSH_UPDATE` control-channel message
901
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
902
* PUSH_UPDATE server support (minimal)
903
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
904
* TLS 1.3 support with bleeding-edge mbedTLS versions
905
* Support for mbedTLS version 4
906
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
907
* Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
908
* "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
909
* COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo
910
911
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.0/Changes.rst)
912
f35e01 uddr 2026-02-19 13:08:59 913
Note: Windows MSI was updated to I017 on February 19th. Changes in I017:
914
* msi: use Wix Util:EventSource to register OpenVPNService event source instead of PowerShell. GH: [openvpn-build #1230](https://github.com/OpenVPN/openvpn-build/issues/1230)
915
* Included dco-win driver updated to 2.8.2
916
* [CVE-2026-2738](https://www.cve.org/CVERecord?id=CVE-2026-2738): Fix TX buffer overflow in epoch AEAD encryption. GH: [ovpn-dco-win #130](https://github.com/OpenVPN/ovpn-dco-win/issues/130)
917
586cd5 flichtenheld 2026-02-11 12:56:28 918
| | | |
919
|-|-|-|
f35e01 uddr 2026-02-19 13:08:59 920
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.0-I017-amd64.msi.asc)|[OpenVPN-2.7.0-I017-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.0-I017-amd64.msi)|
921
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.0-I017-arm64.msi.asc)|[OpenVPN-2.7.0-I017-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.0-I017-arm64.msi)|
922
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.0-I017-x86.msi.asc)|[OpenVPN-2.7.0-I017-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7.0-I017-x86.msi)|
586cd5 flichtenheld 2026-02-11 12:56:28 923
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7.0.tar.gz.asc)|[openvpn-2.7.0.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7.0.tar.gz)|
924
925
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
926
8416a7 flichtenheld 2026-02-04 18:04:59 927
## OpenVPN 2.6.19 -- Released 4 February 2026
928
The OpenVPN community project team is proud to release OpenVPN 2.6.19. This is a bugfix release.
929
2.6.19 only fixes one small issue in the creation of the 2.6.18 release tarball. It was released
930
on the same day as 2.6.18.
931
932
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.19/Changes.rst)
933
934
Bugfixes:
935
* `make dist` would fail to pack `unit_tests/openvpn/test_common.h`,
936
breaking `make check` on the tarball if cmocka is installed. Fix.
937
938
| | | |
939
|-|-|-|
940
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.19-I001-amd64.msi.asc)|[OpenVPN-2.6.19-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.19-I001-amd64.msi)|
941
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.19-I001-arm64.msi.asc)|[OpenVPN-2.6.19-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.19-I001-arm64.msi)|
942
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.19-I001-x86.msi.asc)|[OpenVPN-2.6.19-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.19-I001-x86.msi)|
943
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.19.tar.gz.asc)|[openvpn-2.6.19.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.19.tar.gz)|
944
945
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
946
fbee78 flichtenheld 2026-02-04 14:23:26 947
## OpenVPN 2.6.18 -- Released 4 February 2026
948
The OpenVPN community project team is proud to release OpenVPN 2.6.18. This is a bugfix release.
949
950
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.18/Changes.rst)
951
952
User visible changes:
953
* disable DCO if `--bind-dev` option is given (no support for this in
954
the old out-of-kernel Linux DCO implementation)
955
* on Windows, if using `--ip-win32 netsh` and not using the interactive
956
service, IPv4 addresses would be installed as "permanent", possibly
957
causing problems later on with using that IPv4 address on a different
958
interface. Change to "store=active". (GH: [#915](https://github.com/OpenVPN/openvpn/issues/915))
959
* improve pull-filter documentation, emphasizing possible problems if
960
used as a naive security measure (reported by SRLabs)
961
962
Bugfixes:
963
* p2mp server: fix incorrect file descriptor handling on "inotify" FD
964
during a SIGUSR1 restart (GH: [#966](https://github.com/OpenVPN/openvpn/issues/966))
965
* management interface: fix bug where `--management-forget-disconnect`
966
and `--management-signal` could be executed even if password authentication
967
to managment interface was still pending (ZeroPath finding)
968
* repair client-side interaction on reconnect between DCO event handling
969
and `--persist-tun` - after a ping timeout and reconnect, the DCO
970
event handler would not be armed, and the next ping timeout would not
971
be received by userland, causing non-working connections with nothing
972
in the openvpn log (Linux and FreeBSD only, GH: [#947](https://github.com/OpenVPN/openvpn/issues/947))
973
- prevent crash on invalid server-ipv6 argument, calling `freeaddrinfo()`
974
with a NULL pointer. This only affects OpenBSD. (Klemens Nanni).
975
976
Windows MSI changes since 2.6.17-I001:
977
* Built against OpenSSL 3.6.1
978
* Included openvpn-gui updated to 11.61.0.0
979
* translation updates
980
981
| | | |
982
|-|-|-|
983
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.18-I001-amd64.msi.asc)|[OpenVPN-2.6.18-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.18-I001-amd64.msi)|
984
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.18-I001-arm64.msi.asc)|[OpenVPN-2.6.18-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.18-I001-arm64.msi)|
985
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.18-I001-x86.msi.asc)|[OpenVPN-2.6.18-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.18-I001-x86.msi)|
986
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.18.tar.gz.asc)|[openvpn-2.6.18.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.18.tar.gz)|
987
988
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
989
1b7e87 flichtenheld 2026-01-28 16:33:47 990
## OpenVPN 2.7_rc6 -- Released 28 January 2026
991
The OpenVPN community project team is proud to release OpenVPN 2.7_rc6. This is the sixth release candidate for the feature release 2.7.0.
992
993
Important changes since 2.7_rc5:
994
* bugfix on restarting a p2mp server instance with SIGUSR1 (inadvertedly
995
closing fd 0, causing a crash on the next restart - GH [OpenVPN/openvpn#966](https://github.com/OpenVPN/openvpn/issues/966))
996
* prevent NULL pointer crash on suitable combination of --dns-updown
997
statements in openvpn config file (not pushable)
998
* prevent inappropriate management interface activity if a password is
999
set and --management-forget-disconnect or --management-signal are active
1000
* add mbedTLS 4 support
1001
1002
For a list of all changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_rc5...v2.7_rc6).
1003
1004
Highlights of 2.7 include:
1005
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1006
* Improved Client support for DNS options
1007
* Client implementations for Linux/BSD/macOS, included with the default install
1008
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
1009
* Architectural improvements on Windows
1010
* The `block-local` flag is now enforced with WFP filters
1011
* Windows network adapters are now generated on demand
1012
* Windows automatic service now runs as an unpriviledged user
1013
* Support for server mode in win-dco driver
1014
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
1015
* Improved data channel
1016
* Enforcement of AES-GCM usage limit
1017
* Epoch data keys and packet format
1018
* Support for new upstream DCO Linux kernel module
1019
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
1020
* Client-side support for new `PUSH_UPDATE` control-channel message
1021
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
1022
* PUSH_UPDATE server support (minimal)
1023
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
1024
* TLS 1.3 support with bleeding-edge mbedTLS versions
1025
* Support for mbedTLS version 4
1026
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
1027
* Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
1028
* "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
1029
* COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo
1030
1031
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_rc6/Changes.rst)
1032
7281a5 flichtenheld 2026-02-04 16:00:45 1033
Windows MSI was updated on Feb 4th to 2.7_rc6-I015 to rebuild with updated OpenSSL 3.6.1.
1034
1b7e87 flichtenheld 2026-01-28 16:33:47 1035
| | | |
1036
|-|-|-|
1037
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc6-I014-amd64.msi.asc)|[OpenVPN-2.7_rc6-I014-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc6-I014-amd64.msi)|
1038
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc6-I014-arm64.msi.asc)|[OpenVPN-2.7_rc6-I014-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc6-I014-arm64.msi)|
1039
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc6-I014-x86.msi.asc)|[OpenVPN-2.7_rc6-I014-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc6-I014-x86.msi)|
1040
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc6.tar.gz.asc)|[openvpn-2.7_rc6.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc6.tar.gz)|
1041
1042
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1043
a0aa83 uddr 2026-01-15 18:06:38 1044
## OpenVPN 2.7_rc5 -- Released 15 January 2026
1045
The OpenVPN community project team is proud to release OpenVPN 2.7_rc5. This is the fifth release candidate for the feature release 2.7.0.
1046
1047
Security fixes:
1048
* [CVE-2025-15497](https://www.cve.org/CVERecord?id=CVE-2025-15497): in epoch key handling (an authenticated remote system
1049
can send a valid OpenVPN data packet that triggers an edge case
1050
where a too-strict check would trigger an ASSERT(), exiting OpenVPN)
1051
1052
Important bug fixes since 2.7_rc4:
1053
* remove "resolve --remote on incoming TCP connects on --tcp-server"
1054
code base, because that did not work in a long time (since 2.4) and
1055
is seen as too obscure and too complicated to rescue.
1056
* repair interaction between DCO and persist-tun after reconnection
1057
(in this case the client side would fail to set up the DCO event
1058
handler, and not notice further --ping timeouts - GH: #947)
1059
* remove ENABLE_X509ALTUSERNAME conditional, always enabling
1060
"configure --enable-x509-alt-username". Effectively no change in
1061
code size, and one less build variant to maintain and test (GH: [OpenVPN/openvpn#917](https://github.com/OpenVPN/openvpn/issues/917)).
1062
* require "script-security 2" when using `--dev unix:<program>`
1063
* socks client: fix and improve various code parts
1064
* configure etc: drop support for systemd 216 and older, adapt
1065
other checks to reflect modern systemd setups
1066
* fix unit test building with libcmocka 2.0+
1067
* fix Android build warnings about unused variables/methods
1068
* allow --test-crypto to run without --secret
1069
(prepare for removal of --secret after 2.7)
1070
* improve WolfSSL build compatibility
1071
1072
For a list of all changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_rc4...v2.7_rc5).
1073
1074
Highlights of 2.7 include:
1075
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1076
* Improved Client support for DNS options
1077
* Client implementations for Linux/BSD/macOS, included with the default install
1078
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
1079
* Architectural improvements on Windows
1080
* The `block-local` flag is now enforced with WFP filters
1081
* Windows network adapters are now generated on demand
1082
* Windows automatic service now runs as an unpriviledged user
1083
* Support for server mode in win-dco driver
1084
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
1085
* Improved data channel
1086
* Enforcement of AES-GCM usage limit
1087
* Epoch data keys and packet format
1088
* Support for new upstream DCO Linux kernel module
1089
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
1090
* Client-side support for new `PUSH_UPDATE` control-channel message
1091
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
1092
* PUSH_UPDATE server support (minimal)
1093
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
1094
* TLS 1.3 support with bleeding-edge mbedTLS versions
1095
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
1096
* Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
1097
* "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
1098
* COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo
1099
1100
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_rc5/Changes.rst)
1101
1102
Windows MSI changes since 2.7_rc4:
1103
* Built against OpenSSL 3.6.0
1104
* Included openvpn-gui updated to 11.61.0.0
1105
* Included win-dco driver updated to 2.8.0
1106
1107
| | | |
1108
|-|-|-|
1109
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc5-I013-amd64.msi.asc)|[OpenVPN-2.7_rc5-I013-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc5-I013-amd64.msi)|
1110
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc5-I013-arm64.msi.asc)|[OpenVPN-2.7_rc5-I013-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc5-I013-arm64.msi)|
1111
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc5-I013-x86.msi.asc)|[OpenVPN-2.7_rc5-I013-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc5-I013-x86.msi)|
1112
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc5.tar.gz.asc)|[openvpn-2.7_rc5.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc5.tar.gz)|
1113
1114
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1115
257cb5 uddr 2025-12-17 19:05:32 1116
## OpenVPN 2.7_rc4 -- Released 17 December 2025
1117
The OpenVPN community project team is proud to release OpenVPN 2.7_rc4. This is the fourth release candidate for the feature release 2.7.0.
1118
1119
Important bug fixes since 2.7_rc3:
1120
* Windows interactive service: do not configure adapter DNS if
1121
there are no search-domains but there are resolve-domains (which
1122
get resolved via NRPT rules) - GH: [OpenVPN/openvpn#473](https://github.com/OpenVPN/openvpn/issues/473)
1123
* improve documentation and error messages for a number of deprecated
1124
options
1125
* improve documentation for not-really-deprecated-yet ``--ns-cert-type``
1126
* Windows IPv4 configuration with netsh.exe: ensure addresses are added
1127
with "store=active" (ensure proper cleanup) - GH: [OpenVPN/openvpn#915](https://github.com/OpenVPN/openvpn/issues/915)
1128
* Windows: set UTF8 code page in openvpn.exe manifest, to make cert/key
1129
loading work again for files with non-ASCII characters in their file
1130
name (GH: [OpenVPN/openvpn#920](https://github.com/OpenVPN/openvpn/issues/920))
1131
* tun.c: unify read_tun()/write_tun() functions for all BSD platforms
1132
* more type conversion related cleanups
1133
* add NULL check before freeaddrinfo() call, which might lead to a
1134
crash on OpenBSD (GH: [OpenVPN/openvpn#930](https://github.com/OpenVPN/openvpn/issues/930))
1135
* add NULL check to mbedtls handling of external and inline certificates
1136
* add check for auth none / cipher none on FreeBSD DCO
1137
* add CAP_SYS_NICE to positive list in Linux systemd unit files
1138
(GH: [OpenVPN/openvpn#834](https://github.com/OpenVPN/openvpn/issues/834))
1139
* drop mbedtls 2.x support (which is end of life, and work on mbedtls 4
1140
is much simplified by not having to take care of 2.x compat as well)
1141
* PUSH_UPDATE: bugfix for the client side where split/continued messages
1142
(due to large number of "route" statements) would not correctly handle
1143
the full set of routes. Add unit test. (GH: [OpenVPN/openvpn#925](https://github.com/OpenVPN/openvpn/issues/925))
1144
* new unit test module for mbuf handling
1145
* deprecate --fast-io option (it got partially broken by the multisocket
1146
implementation, and the benefits of the existing implementation did
1147
not outweigh the extra code complexity to make it work again)
1148
* change the ssl_ctx in struct tls_options to be a pointer - this is
1149
a shared data structure between various contexts, but previously it
1150
was shallow-copied, leading to needless CRL reloading - and when
1151
working on implementing the new OpenSSL CRL API, to segfaults
1152
(the existing code works, as these new APIs are not used yet).
1153
1154
For a list of all changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_rc3...v2.7_rc4).
1155
1156
Highlights of 2.7 include:
1157
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1158
* Improved Client support for DNS options
1159
* Client implementations for Linux/BSD/macOS, included with the default install
1160
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
1161
* Architectural improvements on Windows
1162
* The `block-local` flag is now enforced with WFP filters
1163
* Windows network adapters are now generated on demand
1164
* Windows automatic service now runs as an unpriviledged user
1165
* Support for server mode in win-dco driver
1166
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
1167
* Improved data channel
1168
* Enforcement of AES-GCM usage limit
1169
* Epoch data keys and packet format
1170
* Support for new upstream DCO Linux kernel module
1171
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
1172
* Client-side support for new `PUSH_UPDATE` control-channel message
1173
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
1174
* PUSH_UPDATE server support (minimal)
1175
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
1176
* TLS 1.3 support with bleeding-edge mbedTLS versions
1177
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
1178
* Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
1179
* "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
1180
* COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo
1181
1182
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_rc4/Changes.rst)
1183
1184
Windows MSI changes since 2.7_rc3:
1185
* Built against OpenSSL 3.6.0
1186
* Included openvpn-gui updated to 11.60.0.0
1187
* Update copyright year in About dialog
1188
* Included win-dco driver updated to 2.8.0
1189
1190
| | | |
1191
|-|-|-|
1192
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc4-I012-amd64.msi.asc)|[OpenVPN-2.7_rc4-I012-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc4-I012-amd64.msi)|
1193
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc4-I012-arm64.msi.asc)|[OpenVPN-2.7_rc4-I012-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc4-I012-arm64.msi)|
1194
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc4-I012-x86.msi.asc)|[OpenVPN-2.7_rc4-I012-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc4-I012-x86.msi)|
1195
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc4.tar.gz.asc)|[openvpn-2.7_rc4.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc4.tar.gz)|
1196
1197
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1198
28d111 uddr 2025-11-28 18:07:25 1199
## OpenVPN 2.7_rc3 -- Released 28 November 2025
1200
The OpenVPN community project team is proud to release OpenVPN 2.7_rc3. This is the third release candidate for the feature release 2.7.0.
1201
1202
Security fixes:
1203
* [CVE-2025-13751](https://www.cve.org/CVERecord?id=CVE-2025-13751): Windows/interactive service: fix bug where the interactive service would error-exit in
1204
certain error conditions instead of just logging the fact and
1205
continuing. After the error-exit, OpenVPN connections will no
1206
longer work until the service is restarted (or the system rebooted).
1207
This can be triggered by any authenticated local user, and has
1208
thus been classified as a "local denial of service" attack.
1209
1210
Important bug fixes since 2.7_rc2:
1211
* Windows/Interactive Service bugfixes:
1212
many small bugfixes to registry-related DNS domain handling
1213
* Windows/Interactive Service: harden service pipe handling
1214
close a small race condition, and add restrictive ACLs
1215
* more type conversion related warnings have been fixed
1216
* --multihome behaviour regarding egress interface selection has been
1217
changed. See Changes.rst and manpage for details.
1218
* cleanup dead code in event handling code (leftover of the multisocket
1219
patch set)
1220
* add new feature, --tls-crypt-v2-max-age n. See Changes.rst and
1221
manpage for details.
1222
* improve documentation to point out the pitfalls of case-insensitive
1223
filesystems and --client-config-dir
1224
* split default gateway query logic in two:
1225
* for --redirect-gateway functionality, query for the gateway towards
1226
the actual IP address of the VPN server connecting to
1227
* for the "net_gateway" special destination for --route, and the
1228
corresponding environment variable, always query for 0.0.0.0 / ::
1229
(this will only make a difference in certain scenarios using a local
1230
proxy, or on a system with multiple interfaces, not using the "default
1231
route" for the VPN connection * see github#890)
1232
* upgrade embedded pkcs11-helper vcpkg + pkcs11-uri patch to 1.31
1233
* CMake / autoconf cleanup wrt unused checks, outdated old-Linux checks,
1234
Windows oddities
1235
* DCO (primarily Linux): improve handling of bulk notifications from
1236
kernel (do not lose notifications, do not crash) ([github#900](https://github.com/OpenVPN/openvpn/issues/900))
1237
1238
For a list of all changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_rc2...v2.7_rc3).
1239
1240
Highlights of 2.7 include:
1241
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1242
* Improved Client support for DNS options
1243
* Client implementations for Linux/BSD/macOS, included with the default install
1244
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
1245
* Architectural improvements on Windows
1246
* The `block-local` flag is now enforced with WFP filters
1247
* Windows network adapters are now generated on demand
1248
* Windows automatic service now runs as an unpriviledged user
1249
* Support for server mode in win-dco driver
1250
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
1251
* Improved data channel
1252
* Enforcement of AES-GCM usage limit
1253
* Epoch data keys and packet format
1254
* Support for new upstream DCO Linux kernel module
1255
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
1256
* Client-side support for new `PUSH_UPDATE` control-channel message
1257
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
1258
* PUSH_UPDATE server support (minimal)
1259
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
1260
* TLS 1.3 support with bleeding-edge mbedTLS versions
1261
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
1262
* Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
1263
* "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
1264
* COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo
1265
1266
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_rc3/Changes.rst)
1267
1268
Windows MSI changes since 2.7_rc2:
1269
* Built against OpenSSL 3.6.0
1270
* Included openvpn-gui updated to 11.59.0.0
1271
* Authorize config before opening the service pipe
1272
* Remove dependence on pathcch.dll not in Windows 7
1273
* Included win-dco driver updated to 2.8.0
1274
1275
| | | |
1276
|-|-|-|
1277
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc3-I010-amd64.msi.asc)|[OpenVPN-2.7_rc3-I010-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc3-I010-amd64.msi)|
1278
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc3-I010-arm64.msi.asc)|[OpenVPN-2.7_rc3-I010-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc3-I010-arm64.msi)|
1279
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc3-I010-x86.msi.asc)|[OpenVPN-2.7_rc3-I010-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc3-I010-x86.msi)|
1280
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc3.tar.gz.asc)|[openvpn-2.7_rc3.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc3.tar.gz)|
1281
1282
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1283
1284
## OpenVPN 2.6.17 -- Released 28 November 2025
1285
The OpenVPN community project team is proud to release OpenVPN 2.6.17. This is a bugfix release containing one security fix.
1286
1287
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.17/Changes.rst)
1288
1289
Security fixes:
1290
1291
* [CVE-2025-13751](https://www.cve.org/CVERecord?id=CVE-2025-13751): Windows/interactive service: fix erroneous exit on error that could be
1292
used by a local Windows users to achieve a local denial-of-service
1293
1294
Bug fixes:
1295
1296
* Windows/interactive service: improve service pipe robustness against
1297
file access races (uuid) and access by unauthorized processes (ACL).
1298
* upgrade bundled build instruction (vcpkg and patch) for pkcs11-helper
1299
to 1.31, fixing a parser bug
1300
1301
Windows MSI changes since 2.6.16-I001:
1302
* Built against OpenSSL 3.6.0
1303
* Included openvpn-gui updated to 11.59.0.0
1304
* Authorize config before opening the service pipe
1305
* Remove dependence on pathcch.dll not in Windows 7
1306
* Included win-dco driver updated to 2.8.0
1307
1308
| | | |
1309
|-|-|-|
1310
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.17-I001-amd64.msi.asc)|[OpenVPN-2.6.17-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.17-I001-amd64.msi)|
1311
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.17-I001-arm64.msi.asc)|[OpenVPN-2.6.17-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.17-I001-arm64.msi)|
1312
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.17-I001-x86.msi.asc)|[OpenVPN-2.6.17-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.17-I001-x86.msi)|
1313
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.17.tar.gz.asc)|[openvpn-2.6.17.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.17.tar.gz)|
1314
1315
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
1316
4293c2 uddr 2025-11-17 18:01:55 1317
## OpenVPN 2.7_rc2 -- Released 17 November 2025
1318
The OpenVPN community project team is proud to release OpenVPN 2.7_rc2. This is the second release candidate for the feature release 2.7.0.
1319
1320
Security fixes:
1321
* [CVE-2025-12106](https://www.cve.org/CVERecord?id=CVE-2025-12106): IPv6 address parsing: fix buffer overread on invalid input
1322
* [CVE-2025-13086](https://www.cve.org/CVERecord?id=CVE-2025-13086): HMAC verification check: fix incorrect memcmp() call
1323
1324
Important bug fixes since 2.7_rc1:
1325
* even more type conversion related warnings have been fixed
1326
* DCO FreeBSD improvements:
1327
* improving debug messages (verb 6)
1328
* implement client-side counter handling
1329
* repair --inactive (and document shortcomings)
1330
* repair handling of DCO disconnection notifications in --client mode
1331
* Windows/Service improvements, hardening, bugfixes
1332
* fix DNS address list generation (if 3 or more --dns addresses in use)
1333
* fix DNS server undo_list
1334
* disallow "stdin" as config name unless user has OpenVPN admin privs
1335
* fix compilation errors with MSVC v19
1336
* iservice: improve validation of config path (pathcc lib)
1337
* [NOTE: this breaks OpenVPN compatibility with Windows 7]
1338
* tapctl: refactor, improve output, change driver default to ovpn-dco
1339
* iservice: when restoring iface metrics, enforce correct ifindex
1340
* improve cmocka unit test assert() handling
1341
* PUSH_UPDATE server: fix reporting of client IPs in ``status`` output after pushing a new IPv4/IPv6 address to client
1342
* AEAD cipher safety margins: fix calculation of AEAD blocks in use (old code would undercount blocks)
1343
* fix invalid pointer creation / memory overread in tls_pre_decrypt
1344
* deprecate ``--opt-verify`` (change into no-op + warning)
1345
1346
For a list of all changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_rc1...v2.7_rc2).
1347
1348
Highlights of 2.7 include:
1349
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1350
* Improved Client support for DNS options
1351
* Client implementations for Linux/BSD/macOS, included with the default install
1352
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
1353
* Architectural improvements on Windows
1354
* The `block-local` flag is now enforced with WFP filters
1355
* Windows network adapters are now generated on demand
1356
* Windows automatic service now runs as an unpriviledged user
1357
* Support for server mode in win-dco driver
1358
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
1359
* Improved data channel
1360
* Enforcement of AES-GCM usage limit
1361
* Epoch data keys and packet format
1362
* Support for new upstream DCO Linux kernel module
1363
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
1364
* Client-side support for new `PUSH_UPDATE` control-channel message
1365
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
1366
* PUSH_UPDATE server support (minimal)
1367
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
1368
* TLS 1.3 support with bleeding-edge mbedTLS versions
1369
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
1370
* Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
1371
* "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
1372
* COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo
1373
1374
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_rc2/Changes.rst)
1375
1376
Windows MSI changes since 2.7_rc1:
1377
* Built against OpenSSL 3.6.0
1378
* Included openvpn-gui updated to 11.58.0.0
1379
* Check the return value of GetProp()
1380
* Make config path check similar to that in interactive service
1381
* Escape the type id of password message received from openvpn
1382
* Add a message source for event logging
1383
* Check correct management daemon path when OpenVPN3 is enabled
1384
* Fix OpenVPN3 radio button label size when OVPN3 is enabled
1385
* Use GetTempPath() for debug file in plap as well
1386
* Migrate all saved plain usernames to encrypted format
1387
* Included win-dco driver updated to 2.8.0
1388
1389
| | | |
1390
|-|-|-|
1391
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc2-I009-amd64.msi.asc)|[OpenVPN-2.7_rc2-I009-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc2-I009-amd64.msi)|
1392
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc2-I009-arm64.msi.asc)|[OpenVPN-2.7_rc2-I009-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc2-I009-arm64.msi)|
1393
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc2-I009-x86.msi.asc)|[OpenVPN-2.7_rc2-I009-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc2-I009-x86.msi)|
1394
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc2.tar.gz.asc)|[openvpn-2.7_rc2.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc2.tar.gz)|
1395
1396
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1397
1398
## OpenVPN 2.6.16 -- Released 17 November 2025
1399
The OpenVPN community project team is proud to release OpenVPN 2.6.16. This is a bugfix release containing one security fix.
1400
1401
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.16/Changes.rst)
1402
1403
Security fixes:
1404
1405
* [CVE-2025-13086](https://www.cve.org/CVERecord?id=CVE-2025-13086): Fix memcmp check for the hmac verification in the 3way handshake.
1406
This bug renders the HMAC based protection against state exhaustion on
1407
receiving spoofed TLS handshake packets in the OpenVPN server inefficient.
1408
1409
Bug fixes:
1410
1411
* fix invalid pointer creation in tls_pre_decrypt() - technically this is
1412
a memory over-read issue, in practice, the compilers optimize it away
1413
so no negative effects could be observed.
1414
* Windows: in the interactive service, fix the "undo DNS config" handling.
1415
* Windows: in the interactive service, disallow using of "stdin" for the
1416
config file, unless the caller is authorized OpenVPN Administrator
1417
* Windows: in the interactive service, change all netsh calls to use
1418
interface index and not interface name - sidesteps all possible attack
1419
avenues with special characters in interface names.
1420
* Windows: in the interactive service, improve error handling in
1421
some "unlikely to happen" paths.
1422
* auth plugin/script handling: properly check for errors in creation on
1423
$auth_failed_reason_file (arf).
1424
* for incoming TCP connections, close-on-exec option was applied to
1425
the wrong socket fd, leaking socket FDs to child processes.
1426
* sitnl: set close-on-exec flag on netlink socket
1427
* ssl_mbedtls: fix missing perf_pop() call (optional performance profiling)
1428
1429
Windows MSI changes since 2.6.15-I001:
1430
* Built against OpenSSL 3.6.0
1431
* Included openvpn-gui updated to 11.58.0.0
1432
* Check the return value of GetProp()
1433
* Make config path check similar to that in interactive service
1434
* Escape the type id of password message received from openvpn
1435
* Add a message source for event logging
1436
* Check correct management daemon path when OpenVPN3 is enabled
1437
* Fix OpenVPN3 radio button label size when OVPN3 is enabled
1438
* Use GetTempPath() for debug file in plap as well
1439
* Migrate all saved plain usernames to encrypted format
1440
* Included win-dco driver updated to 2.8.0
1441
1442
| | | |
1443
|-|-|-|
1444
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.16-I001-amd64.msi.asc)|[OpenVPN-2.6.16-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.16-I001-amd64.msi)|
1445
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.16-I001-arm64.msi.asc)|[OpenVPN-2.6.16-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.16-I001-arm64.msi)|
1446
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.16-I001-x86.msi.asc)|[OpenVPN-2.6.16-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.16-I001-x86.msi)|
1447
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.16.tar.gz.asc)|[openvpn-2.6.16.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.16.tar.gz)|
1448
1449
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
1450
841f03 uddr 2025-10-31 15:32:51 1451
## OpenVPN 2.7_rc1 -- Released 31 October 2025
1452
The OpenVPN community project team is proud to release OpenVPN 2.7_rc1. This is the first release candidate for the feature release 2.7.0.
1453
1454
Feature changes since 2.7_beta3:
1455
* add warning for unsupported combination of --push and --tls-server
1456
* add warning for unsupported combination of `--reneg-bytes` or `--reneg-pkts` with DCO
1457
* remove perf_push()/perf_pop() infrastructure (because it did not work anymore, and compiler profiling will give better results today)
1458
* ensure compatibility with OpenSSL 3.6.0 - specifically, do not crash in t_lpback.sh trying to use new encrypt-then-mac (ETM) ciphers
1459
* improved PUSH_UPDATE server side support, which now handles changes of pushed ifconfig/ifconfig-ipv6 addresses correctly (send packets to new IP addresses to this client, stop sending packets to the old addresses).
1460
* freshen URLs all over the tree, and change to HTTPS where possible
1461
* on DCO Linux/FreeBSD, add support for clients receiving an IPv4/IPv6 address that is not part of the --server/--server-ipv6 subnet (= install extra on-interface host routes).
1462
* Windows programs use a new API for path name canonicalization now (PathCchCanonicalizeEx()) which will break building with MinGW on Ubuntu 22.04 -> Upgrade to 24.04 to make builds work again.
1463
* on Windows, when setting up WINS servers using netsh, use interface index instead of adapter name now ("as for all other netsh calls")
1464
* remove undocumented and unused --memstats feature
1465
1466
Important bug fixes since 2.7_beta3:
1467
* even more type conversion related warnings have been fixed
1468
* more bugfixes related to BYTECOUNT display on the management interface and byte counters on DCO platforms in general
1469
* numerous minibugs reported by ZeroPath AI have been fixed (small memleaks, possible file descriptor leaks, improved sanity checks, add ASSERT() on function contracts, etc.)
1470
1471
For a list of all changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_beta3...v2.7_rc1).
1472
1473
Highlights of 2.7 include:
1474
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1475
* Improved Client support for DNS options
1476
* Client implementations for Linux/BSD/macOS, included with the default install
1477
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
1478
* Architectural improvements on Windows
1479
* The `block-local` flag is now enforced with WFP filters
1480
* Windows network adapters are now generated on demand
1481
* Windows automatic service now runs as an unpriviledged user
1482
* Support for server mode in win-dco driver
1483
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
1484
* Improved data channel
1485
* Enforcement of AES-GCM usage limit
1486
* Epoch data keys and packet format
1487
* Support for new upstream DCO Linux kernel module
1488
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
1489
* Client-side support for new `PUSH_UPDATE` control-channel message
1490
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
1491
* PUSH_UPDATE server support (minimal)
1492
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
1493
* TLS 1.3 support with bleeding-edge mbedTLS versions
1494
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
1495
* Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
1496
* "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
1497
* COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo
1498
1499
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_rc1/Changes.rst)
1500
1501
Windows MSI changes since 2.7_beta3:
1502
* Built against OpenSSL 3.6.0
1503
* Included openvpn-gui updated to 11.57.0.0
1504
* Encrypt username saved in registry
1505
* Avoid blocking calls during WM_OVPN_ECHOMSG processing
1506
* Fixes segfault when echo msg-notify happens with no message to display (Github: [OpenVPN/openvpn-gui#771](https://github.com/OpenVPN/openvpn-gui/issues/771))
1507
* Check the path of the process listening on management port
1508
* Error out if imported profile file name is too long
1509
* Disallow Windows special filenames for imported profile
1510
* Replace % characters in param->id as it's used in format template
1511
* Excplicitly check that urls start with http:// or https://
1512
* Included win-dco driver updated to 2.8.0
1513
1514
| | | |
1515
|-|-|-|
1516
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc1-I008-amd64.msi.asc)|[OpenVPN-2.7_rc1-I008-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc1-I008-amd64.msi)|
1517
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc1-I008-arm64.msi.asc)|[OpenVPN-2.7_rc1-I008-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc1-I008-arm64.msi)|
1518
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc1-I008-x86.msi.asc)|[OpenVPN-2.7_rc1-I008-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_rc1-I008-x86.msi)|
1519
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc1.tar.gz.asc)|[openvpn-2.7_rc1.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_rc1.tar.gz)|
1520
1521
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1522
0a4a6d uddr 2025-10-13 15:22:13 1523
## OpenVPN 2.7_beta3 -- Released 13 October 2025
1524
The OpenVPN community project team is proud to release OpenVPN 2.7_beta3. This is the third Beta release for the feature release 2.7.0. As the Beta name implies this is an early release build, it is not intended for production use.
1525
1526
Feature changes since 2.7_beta2:
1527
* improvements on PUSH_UPDATE handling on the server side
1528
* improve "recursive routing checks", prepare the way for a policy-based setup where "packets to VPN server" could end up in the tunnel without interfering with OpenVPN operations
1529
* add support for "eoch" data format to DCO on Windows (needs dco-win driver 2.8.0+)
1530
* clean up and remove outdated stuff from COPYING
1531
1532
Important bug fixes since 2.7_beta2:
1533
* bugfixes reconnect and PUSH_UPDATE handling on the client side (notably handling of ifconfig/ifconfig-ipv6/redirect-gateway ipv6 if the server is not always pushing the same address families)
1534
1535
For a list of all changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_beta2...v2.7_beta3).
1536
1537
Highlights of 2.7 include:
1538
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1539
* Improved Client support for DNS options
1540
* Client implementations for Linux/BSD/macOS, included with the default install
1541
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
1542
* Architectural improvements on Windows
1543
* The `block-local` flag is now enforced with WFP filters
1544
* Windows network adapters are now generated on demand
1545
* Windows automatic service now runs as an unpriviledged user
1546
* Support for server mode in win-dco driver
1547
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
1548
* Improved data channel
1549
* Enforcement of AES-GCM usage limit
1550
* Epoch data keys and packet format
1551
* Support for new upstream DCO Linux kernel module
1552
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
1553
* Client-side support for new `PUSH_UPDATE` control-channel message
1554
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
1555
* PUSH_UPDATE server support (minimal)
1556
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
1557
* TLS 1.3 support with bleeding-edge mbedTLS versions
1558
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
1559
* Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+)
1560
* "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server.
1561
* COPYING: license details only relevant to our Windows installers havebeen updated and moved to the openvpn-build repo
1562
1563
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_beta3/Changes.rst)
1564
1565
Windows MSI changes since 2.7_beta2:
1566
* Built against OpenSSL 3.6.0
1567
* Included openvpn-gui updated to 11.56.0.0
1568
* Included win-dco driver updated to 2.8.0
1569
1570
| | | |
1571
|-|-|-|
1572
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta3-I007-amd64.msi.asc)|[OpenVPN-2.7_beta3-I007-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta3-I007-amd64.msi)|
1573
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta3-I007-arm64.msi.asc)|[OpenVPN-2.7_beta3-I007-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta3-I007-arm64.msi)|
1574
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta3-I007-x86.msi.asc)|[OpenVPN-2.7_beta3-I007-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta3-I007-x86.msi)|
1575
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_beta3.tar.gz.asc)|[openvpn-2.7_beta3.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_beta3.tar.gz)|
1576
1577
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1578
e40f74 uddr 2025-09-25 08:51:47 1579
## OpenVPN 2.7_beta2 -- Released 25 September 2025
1580
The OpenVPN community project team is proud to release OpenVPN 2.7_beta2. This is the second Beta release for the feature release 2.7.0. As the Beta name implies this is an early release build, it is not intended for production use.
1581
1582
Feature changes since 2.7_beta1:
1583
* greatly improved event log handling for the Windows interactive service - this brings build system changes and a new openvpnservmsg.dll
1584
1585
Important bug fixes since 2.7_beta1:
1586
* add proper input sanitation to DNS strings to prevent an attack coming from a trusted-but-malicous OpenVPN server ([CVE-2025-10680](https://www.cve.org/CVERecord?id=CVE-2025-10680), affects unixoid systems with `--dns-updown` scripts and windows using the built-in powershell call)
1587
* bugfixes when using multi-socket on windows (properly recognize that TCP server mode does not work with DCO, properly handle TCP multi-socket server setups without DCO)
1588
* bring back configuring of IPv4 broadcast addresses on Linux
1589
* repair "--dhcp-option DNS" setting in combination with DHCP (TAP) or "--up" scripts (Github: [OpenVPN/openvpn#839](https://github.com/OpenVPN/openvpn/issues/839), [OpenVPN/openvpn#840](https://github.com/OpenVPN/openvpn/issues/840))
1590
1591
For a list of all changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_beta1...v2.7_beta2).
1592
1593
Highlights of 2.7 include:
1594
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1595
* Improved Client support for DNS options
1596
* Client implementations for Linux/BSD/macOS, included with the default install
1597
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
1598
* Architectural improvements on Windows
1599
* The `block-local` flag is now enforced with WFP filters
1600
* Windows network adapters are now generated on demand
1601
* Windows automatic service now runs as an unpriviledged user
1602
* Support for server mode in win-dco driver
1603
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
1604
* Improved data channel
1605
* Enforcement of AES-GCM usage limit
1606
* Epoch data keys and packet format
1607
* Support for new upstream DCO Linux kernel module
1608
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
1609
* Client-side support for new `PUSH_UPDATE` control-channel message
1610
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
1611
* PUSH_UPDATE server support (minimal)
1612
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
1613
* TLS 1.3 support with bleeding-edge mbedTLS versions
1614
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
1615
1616
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_beta2/Changes.rst)
1617
1618
Windows MSI changes since 2.7_beta1:
1619
* Built against OpenSSL 3.5.3
1620
* Included openvpn-gui updated to 11.56.0.0
1621
* Fix "Cannot open the System Tray Menu with Keyboard" (Github: [OpenVPN/openvpn-gui#763](https://github.com/OpenVPN/openvpn-gui/issues/763))
1622
1623
| | | |
1624
|-|-|-|
1625
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta2-I006-amd64.msi.asc)|[OpenVPN-2.7_beta2-I006-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta2-I006-amd64.msi)|
1626
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta2-I006-arm64.msi.asc)|[OpenVPN-2.7_beta2-I006-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta2-I006-arm64.msi)|
1627
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta2-I006-x86.msi.asc)|[OpenVPN-2.7_beta2-I006-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta2-I006-x86.msi)|
1628
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_beta2.tar.gz.asc)|[openvpn-2.7_beta2.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_beta2.tar.gz)|
1629
1630
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1631
2bdbc6 flichtenheld 2025-09-22 14:18:49 1632
## OpenVPN 2.6.15 -- Released 22 September 2025
1633
The OpenVPN community project team is proud to release OpenVPN 2.6.15. This is a bugfix release.
1634
1635
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.15/Changes.rst)
1636
1637
Bug fixes:
1638
1639
* on Windows, do not use "wmic.exe" any longer to set DNS search domain
1640
(discontinued by Microsoft), use "powershell" fragment instead.
1641
* on Windows, logging to the windows event log has been improved
1642
(and logging of GetLastError() strings repaired). To make this work,
1643
a new "openvpnmsgserv.dll" library is now installed and registered.
1644
* DNS domain names are now strictly validated with a positive-list of
1645
allowed characters (including UTF-8 high-bit-set bytes) before being
1646
handed to powershell.
1647
* Apply more checks to incoming TLS handshake packets before creating
1648
new state - namely, verify message ID / acked ID for "valid range for
1649
an initial packet". This fixes a problem with clients that float
1650
very early but send control channel packet from the pre-float IP
1651
(Github: [OpenVPN/openvpn#704](https://github.com/OpenVPN/openvpn/issues/704),
1652
backported from 2.7_beta1.
1653
* backport handling of client float notifications on FreeBSD 14/STABLE DCO
1654
(see https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289303)
1655
* update GPL license text to latest version from FSF
1656
* on Linux, on interfaces where applicable, OpenVPN explicitly configures
1657
the broadcast address again. This was dropped for 2.6.0 "because
1658
computers are smart and can do it themselves", but the kernel netlink
1659
interface isn't, and will install "0.0.0.0". This does not normally
1660
matter, but for broadcast-based applications that get the address to
1661
use from "ifconfig", this change repairs functionality.
1662
1663
Windows MSI changes since 2.6.14-I004:
1664
* Built against OpenSSL 3.5.3
1665
* Included openvpn-gui updated to 11.56.0.0
1666
* Fix "Cannot open the System Tray Menu with Keyboard" (Github: [OpenVPN/openvpn-gui#763](https://github.com/OpenVPN/openvpn-gui/issues/763))
1667
1668
| | | |
1669
|-|-|-|
1670
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.15-I001-amd64.msi.asc)|[OpenVPN-2.6.15-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.15-I001-amd64.msi)|
1671
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.15-I001-arm64.msi.asc)|[OpenVPN-2.6.15-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.15-I001-arm64.msi)|
1672
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.15-I001-x86.msi.asc)|[OpenVPN-2.6.15-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.15-I001-x86.msi)|
1673
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.15.tar.gz.asc)|[openvpn-2.6.15.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.15.tar.gz)|
1674
1675
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
1676
11d54c uddr 2025-09-04 12:57:59 1677
## OpenVPN 2.7_beta1 -- Released 04 September 2025
1678
The OpenVPN community project team is proud to release OpenVPN 2.7_beta1. This is the first Beta release for the feature release 2.7.0. As the Beta name implies this is an early release build, it is not intended for production use.
1679
1680
Feature changes since 2.7_alpha3:
1d4b79 uddr 2025-09-04 13:04:21 1681
* Introduction of `route_redirect_gateway_ipv4` and `_ipv6` env variables
11d54c uddr 2025-09-04 12:57:59 1682
* PUSH_UPDATE server support (via management interface)
1683
* Rewrite of the management interface "bytecount" infastructure to better interact with DCO
1684
1685
Important bug fixes since 2.7_alpha3:
1d4b79 uddr 2025-09-04 13:04:21 1686
* Bugfixes in `--dns-updown` script for linux systems using resolvconf
11d54c uddr 2025-09-04 12:57:59 1687
* A large number of signed/unsigned related warnings have been fixed
1688
1689
For a list of all changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_alpha3...v2.7_beta1).
1690
1691
Highlights of 2.7 include:
1692
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1693
* Improved Client support for DNS options
1694
* Client implementations for Linux/BSD/macOS, included with the default install
1695
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
1696
* Architectural improvements on Windows
1697
* The `block-local` flag is now enforced with WFP filters
1698
* Windows network adapters are now generated on demand
1699
* Windows automatic service now runs as an unpriviledged user
1700
* Support for server mode in win-dco driver
1701
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
1702
* Improved data channel
1703
* Enforcement of AES-GCM usage limit
1704
* Epoch data keys and packet format
1705
* Support for new upstream DCO Linux kernel module
1706
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
1707
* Client-side support for new `PUSH_UPDATE` control-channel message
1708
* This allows servers to send updates to options like routing and DNS config without triggering a reconnect.
1709
* PUSH_UPDATE server support (minimal)
1710
* New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates.
1711
* TLS 1.3 support with bleeding-edge mbedTLS versions
1712
* Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager.
1713
1714
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_beta1/Changes.rst)
1715
1716
Windows MSI changes since 2.7_alpha3:
1717
* Included dco-win driver updated to 2.7.1
1718
* add support for multipeer stats
1719
* Built against OpenSSL 3.5.1
1720
* Included openvpn-gui 11.55.0.0
1721
1722
| | | |
1723
|-|-|-|
7764dc uddr 2025-09-05 06:31:42 1724
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta1-I005-amd64.msi.asc)|[OpenVPN-2.7_beta1-I005-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta1-I005-amd64.msi)|
1725
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta1-I005-arm64.msi.asc)|[OpenVPN-2.7_beta1-I005-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta1-I005-arm64.msi)|
1726
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta1-I005-x86.msi.asc)|[OpenVPN-2.7_beta1-I005-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_beta1-I005-x86.msi)|
11d54c uddr 2025-09-04 12:57:59 1727
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_beta1.tar.gz.asc)|[openvpn-2.7_beta1.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_beta1.tar.gz)|
1728
1729
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1730
3ed674 flichtenheld 2025-08-01 11:54:46 1731
## OpenVPN 2.7_alpha3 -- Released 31 July 2025
1732
The OpenVPN community project team is proud to release OpenVPN 2.7_alpha3. This is the third Alpha release for the feature release 2.7.0. As the Alpha name implies this is an early release build, it is not intended for production use.
1733
1734
Feature changes since 2.7_alpha2:
1735
* ``--dns-updown`` script for macOS
1736
* Client-side support for PUSH_UPDATE handling
1737
* Support for floating TLS clients when DCO is active (requires latest versions of DCO drivers)
1738
* Use of user-defined routing tables on Linux
1739
* PQE support for WolfSSL
1740
1741
Important bug fixes since 2.7_alpha2:
1742
* Fix issue in handling DCO messages on Linux that could lead to various problems due to unhandled messages
1743
* Fix issues with DHCP on Windows with tap driver
1744
60384b flichtenheld 2025-08-01 11:58:55 1745
For a list of all changes in Alpha 3 changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_alpha2...v2.7_alpha3).
3ed674 flichtenheld 2025-08-01 11:54:46 1746
60384b flichtenheld 2025-08-01 11:58:55 1747
For details about 2.7 features see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_alpha3/Changes.rst)
3ed674 flichtenheld 2025-08-01 11:54:46 1748
1749
Windows MSI changes since 2.7_alpha3:
1750
* win-dco driver updated from 2.5.9 to 2.6.2
1751
* Adds float support
1752
* Built against OpenSSL 3.5.1
1753
* Included openvpn-gui updated to 11.55.0.0
1754
* Fix Chinese localization for OpenVPN GUI
1755
1756
| | | |
1757
|-|-|-|
1758
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha3-I004-amd64.msi.asc)|[OpenVPN-2.7_alpha3-I004-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha3-I004-amd64.msi)|
1759
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha3-I004-arm64.msi.asc)|[OpenVPN-2.7_alpha3-I004-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha3-I004-arm64.msi)|
1760
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha3-I004-x86.msi.asc)|[OpenVPN-2.7_alpha3-I004-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha3-I004-x86.msi)|
1761
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_alpha3.tar.gz.asc)|[openvpn-2.7_alpha3.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_alpha3.tar.gz)|
1762
1763
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1764
a891da uddr 2025-06-19 18:48:57 1765
## OpenVPN 2.7_alpha2 -- Released 19 June 2025
32d161 uddr 2025-06-20 13:34:15 1766
The OpenVPN community project team is proud to release OpenVPN 2.7_alpha2. This is the second Alpha release containing bugfixes and one security fix for the feature release 2.7.0. As the Alpha name implies this is an early release build, this is not intended for production use.
a891da uddr 2025-06-19 18:48:57 1767
32d161 uddr 2025-06-20 13:34:15 1768
New feature since 2.7_alpha1:
1769
* TLS 1.3 support with bleeding-edge mbedTLS versions
1770
60384b flichtenheld 2025-08-01 11:58:55 1771
For a list of all changes in Alpha 2 changes see the [git log](https://github.com/OpenVPN/openvpn/compare/v2.7_alpha1...v2.7_alpha2).
1772
1773
For details about 2.7 features see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_alpha2/Changes.rst)
32d161 uddr 2025-06-20 13:34:15 1774
1775
Windows MSI changes since 2.7_alpha1:
021418 novaflash 2025-07-02 12:28:58 1776
* Includes fix for [CVE-2025-50054](https://www.cve.org/CVERecord?id=CVE-2025-50054)
32d161 uddr 2025-06-20 13:34:15 1777
* Built against OpenSSL 3.5.0
1778
* Included openvpn-gui updated to 11.54.0.0
1779
* Improve French (fr) and Turkish (tr) localization for OpenVPN GUI
1780
1781
| | | |
1782
|-|-|-|
891b5a uddr 2025-06-30 12:43:56 1783
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha2-I003-amd64.msi.asc)|[OpenVPN-2.7_alpha2-I003-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha2-I003-amd64.msi)|
1784
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha2-I003-arm64.msi.asc)|[OpenVPN-2.7_alpha2-I003-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha2-I003-arm64.msi)|
1785
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha2-I003-x86.msi.asc)|[OpenVPN-2.7_alpha2-I003-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha2-I003-x86.msi)|
32d161 uddr 2025-06-20 13:34:15 1786
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_alpha2.tar.gz.asc)|[openvpn-2.7_alpha2.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_alpha2.tar.gz)|
1787
1788
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
1789
1790
## OpenVPN 2.7_alpha1 -- Released 28 May 2025
1791
The OpenVPN community project team is proud to release OpenVPN 2.7_alpha1. This is the first Alpha release for the feature release 2.7.0. As the Alpha name implies this is an early release build, this is not intended for production use.
7f6e4e flichtenheld 2025-05-28 21:08:06 1792
1793
Highlights of this release include:
1794
* Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server
1795
* Improved Client support for DNS options
1796
* Client implementations for Linux/BSD, included with the default install
1e8577 flichtenheld 2025-05-28 21:39:29 1797
* New client implementation for Windows, adding support for features like split DNS and DNSSEC
7f6e4e flichtenheld 2025-05-28 21:08:06 1798
* Architectural improvements on Windows
1799
* The `block-local` flag is now enforced with WFP filters
1800
* Windows network adapters are now generated on demand
1801
* Windows automatic service now runs as an unpriviledged user
1802
* Support for server mode in win-dco driver
18cae3 flichtenheld 2025-05-28 21:23:16 1803
* Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco.
7f6e4e flichtenheld 2025-05-28 21:08:06 1804
* Improved data channel
1805
* Enforcement of AES-GCM usage limit
1806
* Epoch data keys and packet format
1e8577 flichtenheld 2025-05-28 21:39:29 1807
* Support for new upstream DCO Linux kernel module
1808
* This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports).
7f6e4e flichtenheld 2025-05-28 21:08:06 1809
32d161 uddr 2025-06-20 13:34:15 1810
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7_alpha1/Changes.rst)
7f6e4e flichtenheld 2025-05-28 21:08:06 1811
1812
Windows MSI changes since 2.6.14:
1813
* Built against OpenSSL 3.5.0
32d161 uddr 2025-06-20 13:34:15 1814
* Included openvpn-gui updated to 11.53.0.0
7f6e4e flichtenheld 2025-05-28 21:08:06 1815
* Support for webauth in PLAP (Pre-Logon Access Provider) via QR code (github [openvpn-gui#687](https://github.com/OpenVPN/openvpn-gui/issues/687))
1816
1817
| | | |
1818
|-|-|-|
32d161 uddr 2025-06-20 13:34:15 1819
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha1-I001-amd64.msi.asc)|[OpenVPN-2.7_alpha1-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha1-I001-amd64.msi)|
1820
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha1-I001-arm64.msi.asc)|[OpenVPN-2.7_alpha1-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha1-I001-arm64.msi)|
1821
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha1-I001-x86.msi.asc)|[OpenVPN-2.7_alpha1-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.7_alpha1-I001-x86.msi)|
1822
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.7_alpha1.tar.gz.asc)|[openvpn-2.7_alpha1.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.7_alpha1.tar.gz)|
7f6e4e flichtenheld 2025-05-28 21:08:06 1823
3c87e8 flichtenheld 2025-05-28 21:16:43 1824
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos). Note that the Fedora Copr repositories have been moved to the @OpenVPN group account and that there are new repositories available on openSUSE Buildservice.
7f6e4e flichtenheld 2025-05-28 21:08:06 1825
76927e uddr 2025-04-02 17:21:23 1826
## OpenVPN 2.6.14 -- Released 02 April 2025
1827
The OpenVPN community project team is proud to release OpenVPN 2.6.14. This is a bugfix release containing one security fix.
1828
1829
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.14/Changes.rst)
1830
1831
Security fixes:
1832
021418 novaflash 2025-07-02 12:28:58 1833
* [CVE-2025-2704](https://www.cve.org/CVERecord?id=CVE-2025-2704): fix possible `ASSERT()` on OpenVPN servers using `--tls-crypt-v2`
76927e uddr 2025-04-02 17:21:23 1834
Security scope: OpenVPN servers between 2.6.1 and 2.6.13 using
1835
`--tls-crypt-v2` can be made to abort with an `ASSERT()` message by
1836
sending a particular combination of authenticated and malformed packets.
1837
To trigger the bug, a valid tls-crypt-v2 client key is needed, or
1838
network observation of a handshake with a valid tls-crypt-v2 client key.
1839
No crypto integrity is violated, no data is leaked, and no remote
1840
code execution is possible.
1841
This bug does not affect OpenVPN clients.
1842
(Bug found by internal QA at OpenVPN Inc)
1843
1844
Bug fixes:
1845
1846
* Linux DCO: repair source IP selection for `--multihome` (Qingfang Deng)
1847
1848
Windows MSI changes since 2.6.13:
1849
* Built against OpenSSL 3.4.1
1850
* Included openvpn-gui updated to 11.52.0.0
1851
* Use correct `%TEMP%` directory for debug log file.
1852
* Disable config in menu listing if its ovpn file becomes inaccessible (github [openvpn-gui#729](https://github.com/OpenVPN/openvpn-gui/issues/729))
1853
dabdb6 uddr 2025-06-19 15:52:55 1854
Note: Windows MSI was updated to I002 on June 19th. Changes in I002:
021418 novaflash 2025-07-02 12:28:58 1855
* Includes fix for [CVE-2025-50054](https://www.cve.org/CVERecord?id=CVE-2025-50054)
1fe933 flichtenheld 2025-08-04 13:54:41 1856
* Built against OpenSSL 3.5.0
1857
* Included openvpn-gui updated to 11.54.0.0
1858
* Support for webauth in PLAP (Pre-Logon Access Provider) via QR code (github [openvpn-gui#687](https://github.com/OpenVPN/openvpn-gui/issues/687))
1859
* Improve French (fr) and Turkish (tr) localization for OpenVPN GUI
1860
* Included dco-win driver updated to 1.3.1
1861
1862
Note: Windows MSI was update to I003 on August 4th. Changes in I003:
1863
* Built against OpenSSL 3.5.1
1864
* Included openvpn-gui updated to 11.55.0.0
1865
* Fix Chinese localization for OpenVPN GUI
1866
* Included dco-win driver updated to 1.3.2
dabdb6 uddr 2025-06-19 15:52:55 1867
62ad76 uddr 2025-08-06 14:40:57 1868
Note: Windows MSI was updated to I004 on August 6th. Changes in I004:
1869
* Included dco-win driver updated to 1.3.3
1870
* Fix for recursive routing behavior
1871
76927e uddr 2025-04-02 17:21:23 1872
| | | |
1873
|-|-|-|
62ad76 uddr 2025-08-06 14:40:57 1874
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.14-I004-amd64.msi.asc)|[OpenVPN-2.6.14-I004-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.14-I004-amd64.msi)|
1875
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.14-I004-arm64.msi.asc)|[OpenVPN-2.6.14-I004-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.14-I004-arm64.msi)|
1876
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.14-I004-x86.msi.asc)|[OpenVPN-2.6.14-I003-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.14-I004-x86.msi)|
76927e uddr 2025-04-02 17:21:23 1877
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.14.tar.gz.asc)|[openvpn-2.6.14.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.14.tar.gz)|
1878
3c87e8 flichtenheld 2025-05-28 21:16:43 1879
For Community-maintained packages for Linux distributions see [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos).
76927e uddr 2025-04-02 17:21:23 1880
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1881
## OpenVPN 2.6.13 -- Released 15 January 2025
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1882
The OpenVPN community project team is proud to release OpenVPN 2.6.13. This is a bugfix release.
1883
1884
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.13/Changes.rst)
1885
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1886
Feature changes:
1887
1888
* on non-windows clients (MacOS, Linux, Unix) send "release" string from
1889
`uname()` call as `IV_PLAT_VER` to server - while highly OS specific this
1890
is still helpful to keep track of OS versions used on the client side
1891
(github [#637](https://github.com/OpenVPN/openvpn/issues/637))
1892
* Windows: protect cached username, password and token in client memory
1893
(using the `CryptProtectMemory()` windows API)
1894
* Windows: use new API to get dco-win driver version from driver
1895
(newly introduced non-exclusive control device) (github [ovpn-dco-win#76](https://github.com/OpenVPN/ovpn-dco-win/issues/76))
1896
* Linux: pass `--timeout=0 argument` to `systemd-ask-password`, to avoid
1897
default timeout of 90 seconds ("console prompting also has no timeout")
1898
(github [#649](https://github.com/OpenVPN/openvpn/issues/649))
1899
1900
Security fixes:
1901
1902
* improve server-side handling of clients sending usernames or passwords
1903
longer than `USER_PASS_LEN` - this would not result in a crash, buffer
1904
overflow or other security issues, but the server would then misparse
1905
incoming IV variables and produce misleading error messages.
1906
1907
Notable bug fixes:
1908
1909
* FreeBSD DCO: fix memory leaks in nvlist handling (github [#636](https://github.com/OpenVPN/openvpn/issues/636))
1910
* purge proxy authentication credentials from memory after use
1911
(if `--auth-nocache` is in use)
1912
1913
Windows MSI changes since 2.6.12:
1914
* Built against OpenSSL 3.4.0
1915
* Included openvpn-gui updated to 11.51.0.0
1916
* Higher resolution eye icons (github [openvpn-gui#697](https://github.com/OpenVPN/openvpn-gui/issues/697))
1917
* Support for concatenating OTP with password
1918
* Optionally always prompt for OTP
1919
* Fix tooltip positioning when the taskbar is at top (github [openvpn-gui#710](https://github.com/OpenVPN/openvpn-gui/issues/710))
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1920
3c87e8 flichtenheld 2025-05-28 21:16:43 1921
Debian/Ubuntu packages in [OpenVPN Software Repositories](/Pages/OpenVPN%20software%20repos) are now available for Ubuntu 24.10 (oracular).
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1922
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1923
| | | |
1924
|-|-|-|
1925
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.13-I001-amd64.msi.asc)|[OpenVPN-2.6.13-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.13-I001-amd64.msi)|
1926
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.12-I001-arm64.msi.asc)|[OpenVPN-2.6.13-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.13-I001-arm64.msi)|
1927
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.13-I001-x86.msi.asc)|[OpenVPN-2.6.13-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.13-I001-x86.msi)|
1928
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.13.tar.gz.asc)|[openvpn-2.6.13.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.13.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1929
1930
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
1931
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1932
## OpenVPN 2.5.11 -- Released 18 July 2024
1933
The OpenVPN community project team is proud to release OpenVPN 2.5.11. This is a security fix release.
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1934
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1935
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.5.11/Changes.rst)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1936
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1937
Security fixes:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1938
021418 novaflash 2025-07-02 12:28:58 1939
- [CVE-2024-5594](https://www.cve.org/CVERecord?id=CVE-2024-5594): control channel: refuse control channel messages with
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1940
nonprintable characters in them. Security scope: a malicious openvpn peer can send garbage to openvpn log, or cause high CPU load.
1941
(Reynir Björnsson)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1942
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1943
(Backport of the security fix in 2.6.11 and the fix for the bugfix
1944
in 2.6.12)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1945
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1946
In accordance with our [support policy](/SupportedVersions) packages and installers are not provided for 2.5 anymore.
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1947
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1948
| | | |
1949
|-|-|-|
1950
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.5.11.tar.gz.asc)|[openvpn-2.5.11.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.5.11.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1951
1952
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1953
## OpenVPN 2.6.12 -- Released 18 July 2024
1954
The OpenVPN community project team is proud to release OpenVPN 2.6.12. This is a bugfix release.
1955
1956
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.12/Changes.rst)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1957
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1958
Bug fixes:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1959
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1960
* the fix for CVE-2024-5594 (refuse control channel messages with
1961
nonprintable characters) was too strict, breaking user configurations
1962
with AUTH_FAIL messages having trailing CR/NL characters. This often
1963
happens if the AUTH_FAIL reason is set by a script. Strip those before
1964
testing the command buffer (github [#568](https://github.com/OpenVPN/openvpn/issues/568)). Also, add unit test.
1965
* Http-proxy: fix bug preventing proxy credentials caching (trac #1187)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1966
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1967
Windows MSI changes since 2.6.11:
1968
* Built against OpenSSL 3.3.1
1969
* Included openvpn-gui updated to 11.50.0.0
1970
* Update Italian language (github [#696](https://github.com/OpenVPN/openvpn-gui/pull/696))
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1971
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1972
| | | |
1973
|-|-|-|
1974
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.12-I001-amd64.msi.asc)|[OpenVPN-2.6.12-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.12-I001-amd64.msi)|
1975
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.12-I001-arm64.msi.asc)|[OpenVPN-2.6.12-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.12-I001-arm64.msi)|
1976
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.12-I001-x86.msi.asc)|[OpenVPN-2.6.12-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.12-I001-x86.msi)|
1977
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.12.tar.gz.asc)|[openvpn-2.6.12.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.12.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1978
1979
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
1980
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1981
## OpenVPN 2.6.11 -- Released 20 June 2024
c14e58 Samuli Seppänen 2025-02-11 07:05:53 1982
The OpenVPN community project team is proud to release OpenVPN 2.6.11. This is a bugfix release containing several security fixes.
1983
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1984
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.11/Changes.rst)
1985
1986
Security fixes:
1987
021418 novaflash 2025-07-02 12:28:58 1988
* [CVE-2024-4877](https://www.cve.org/CVERecord?id=CVE-2024-4877): Windows: harden interactive service pipe.
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1989
Security scope: a malicious process with "some" elevated privileges
1990
(!SeImpersonatePrivilege) could open the pipe a second time, tricking
1991
openvn GUI into providing user credentials (tokens), getting full
1992
access to the account openvpn-gui.exe runs as.
1993
(Zeze with TeamT5)
021418 novaflash 2025-07-02 12:28:58 1994
* [CVE-2024-5594](https://www.cve.org/CVERecord?id=CVE-2024-5594): control channel: refuse control channel messages with
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1995
nonprintable characters in them. Security scope: a malicious openvpn
1996
peer can send garbage to openvpn log, or cause high CPU load.
1997
(Reynir Björnsson)
021418 novaflash 2025-07-02 12:28:58 1998
* [CVE-2024-28882](https://www.cve.org/CVERecord?id=CVE-2024-28882): only call schedule_exit() once (on a given peer).
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 1999
Security scope: an authenticated client can make the server "keep the
2000
session" even when the server has been told to disconnect this client
2001
(Reynir Björnsson)
2002
2003
2004
New features:
2005
2006
* Windows Crypto-API: Implement Windows CA template match for searching
2007
certificates in windows crypto store.
2008
* Support pre-created DCO interface on FreeBSD (OpenVPN would fail to
2009
set ifmode p2p/subnet otherwise)
2010
2011
Bug fixes:
2012
2013
* Fix connect timeout when using SOCKS proxies (trac #328, github [#267](https://github.com/OpenVPN/openvpn/issues/267))
2014
* Work around LibreSSL crashing on OpenBSD 7.5 when enumerating ciphers
2015
(LibreSSL bug, already fixed upstream, but not backported to OpenBSD 7.5,
2016
see also [LibreSSL/OpenBSD#150](https://github.com/libressl/openbsd/issues/150))
2017
* Add bracket in fingerprint message and do not warn about missing
2018
verification (github [#516](https://github.com/OpenVPN/openvpn/issues/516))
2019
2020
Documentation:
2021
2022
* Remove "experimental" denotation for --fast-io
2023
* Correctly document ifconfig_* variables passed to scripts
2024
* Documentation: make section levels consistent
2025
* Samples: Update sample configurations (remove compression & old cipher settings, add more informative comments)
2026
2027
Windows MSI changes since 2.6.10:
2028
* For the Windows-specific security fixes see above
2029
* Built against OpenSSL 3.3.1
2030
* Included openvpn-gui updated to 11.49.0.0
021418 novaflash 2025-07-02 12:28:58 2031
* Contains part of the fix for [CVE-2024-4877](https://www.cve.org/CVERecord?id=CVE-2024-4877)
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2032
2033
Note: Windows MSI was updated to I002 on June 26th. Changes in I002:
2034
* Group names are localized in some localizations, so we have to use SIDs. (Github: [#671](https://github.com/OpenVPN/openvpn-build/issues/671))
2035
2036
| | | |
2037
|-|-|-|
2038
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.11-I002-amd64.msi.asc)|[OpenVPN-2.6.11-I002-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.11-I002-amd64.msi)|
2039
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.11-I002-arm64.msi.asc)|[OpenVPN-2.6.11-I002-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.11-I002-arm64.msi)|
2040
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.11-I002-x86.msi.asc)|[OpenVPN-2.6.11-I002-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.11-I002-x86.msi)|
2041
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.11.tar.gz.asc)|[openvpn-2.6.11.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.11.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2042
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2043
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2044
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2045
## OpenVPN 2.5.10 -- Released 21 March 2024
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2046
The OpenVPN community project team is proud to release OpenVPN 2.5.10. This is a bugfix release containing several security fixes specific to the Windows platform.
2047
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2048
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.5.10/Changes.rst)
2049
2050
Note that OpenVPN 2.5.x is in "Old Stable Support" status (see SupportedVersions). This usually means that we do not provide updated Windows Installers anymore, even for security fixes. Since this release fixes several issues specific to the Windows platform we decided to provide installers anyway. This does not change the support status of 2.5.x branch. We might not provide security updates for issues found in the future. We recommend that everyone switch to the 2.6.x versions of installers as soon as possible.
2051
2052
Security fixes:
2053
021418 novaflash 2025-07-02 12:28:58 2054
* [CVE-2024-27459](https://www.cve.org/CVERecord?id=CVE-2024-27459): Windows: fix a possible stack overflow in the
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2055
interactive service component which might lead to a local privilege
2056
escalation.
2057
Reported-by: Vladimir Tokarev <vtokarev@microsoft.com>
021418 novaflash 2025-07-02 12:28:58 2058
* [CVE-2024-24974](https://www.cve.org/CVERecord?id=CVE-2024-24974): Windows: disallow access to the interactive service
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2059
pipe from remote computers.
2060
Reported-by: Vladimir Tokarev <vtokarev@microsoft.com>
021418 novaflash 2025-07-02 12:28:58 2061
* [CVE-2024-27903](https://www.cve.org/CVERecord?id=CVE-2024-27903): Windows: disallow loading of plugins from untrusted
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2062
installation paths, which could be used to attack `openvpn.exe` via
2063
a malicious plugin. Plugins can now only be loaded from the OpenVPN
2064
install directory, the Windows system directory, and possibly from
2065
a directory specified by `HKLM\SOFTWARE\OpenVPN\plugin_dir`.
2066
Reported-by: Vladimir Tokarev <vtokarev@microsoft.com>
021418 novaflash 2025-07-02 12:28:58 2067
* [CVE-2024-1305](https://www.cve.org/CVERecord?id=CVE-2024-1305): Windows TAP driver: Fix potential integer overflow in !TapSharedSendPacket.
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2068
Reported-by: Vladimir Tokarev <vtokarev@microsoft.com>
2069
2070
Windows MSI changes since 2.5.10:
2071
* For the Windows-specific security fixes see above
2072
* Built against OpenSSL 1.1.1w
2073
* Note that OpenSSL 1.1.1 is not supported anymore, so this might not address all known issues in OpenSSL 1.1.1. If that concerns you, please switch to OpenVPN 2.6.x
2074
* Included tap6-windows driver updated to 9.27.0
2075
* Security fix, see above
2076
2077
| | | |
2078
|-|-|-|
2079
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.10-I601-amd64.msi.asc)|[OpenVPN-2.5.10-I601-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.10-I601-amd64.msi)|
2080
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.10-I601-arm64.msi.asc)|[OpenVPN-2.5.10-I601-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.10-I601-arm64.msi)|
2081
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.10-I601-x86.msi.asc)|[OpenVPN-2.5.10-I601-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.10-I601-x86.msi)|
2082
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.5.10.tar.gz.asc)|[openvpn-2.5.10.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.5.10.tar.gz)|
2083
2084
## OpenVPN 2.6.10 -- Released 20 March 2024
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2085
The OpenVPN community project team is proud to release OpenVPN 2.6.10. This is a bugfix release containing several security fixes specific to the Windows platform.
2086
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2087
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.10/Changes.rst)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2088
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2089
Security fixes:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2090
021418 novaflash 2025-07-02 12:28:58 2091
* [CVE-2024-27459](https://www.cve.org/CVERecord?id=CVE-2024-27459): Windows: fix a possible stack overflow in the
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2092
interactive service component which might lead to a local privilege
2093
escalation.
2094
Reported-by: Vladimir Tokarev <vtokarev@microsoft.com>
021418 novaflash 2025-07-02 12:28:58 2095
* [CVE-2024-24974](https://www.cve.org/CVERecord?id=CVE-2024-24974): Windows: disallow access to the interactive service
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2096
pipe from remote computers.
2097
Reported-by: Vladimir Tokarev <vtokarev@microsoft.com>
021418 novaflash 2025-07-02 12:28:58 2098
* [CVE-2024-27903](https://www.cve.org/CVERecord?id=CVE-2024-27903): Windows: disallow loading of plugins from untrusted
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2099
installation paths, which could be used to attack `openvpn.exe` via
2100
a malicious plugin. Plugins can now only be loaded from the OpenVPN
2101
install directory, the Windows system directory, and possibly from
2102
a directory specified by `HKLM\SOFTWARE\OpenVPN\plugin_dir`.
2103
Reported-by: Vladimir Tokarev <vtokarev@microsoft.com>
021418 novaflash 2025-07-02 12:28:58 2104
* [CVE-2024-1305](https://www.cve.org/CVERecord?id=CVE-2024-1305): Windows TAP driver: Fix potential integer overflow in !TapSharedSendPacket.
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2105
Reported-by: Vladimir Tokarev <vtokarev@microsoft.com>
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2106
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2107
New features:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2108
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2109
* `t_client.sh` can now run pre-tests and skip a test block if needed
2110
(e.g. skip NTLM proxy tests if SSL library does not support MD4)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2111
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2112
User visible changes:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2113
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2114
* Update copyright notices to 2024
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2115
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2116
Bug fixes:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2117
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2118
* Windows: if the win-dco driver is used (default) and the GUI requests
2119
use of a proxy server, the connection would fail. Disable DCO in
2120
this case. (Github: [#522](https://github.com/OpenVPN/openvpn/issues/522))
2121
* Compression: minor bugfix in checking option consistency vs. compiled-in
2122
algorithm support
2123
* systemd unit files: remove obsolete syslog.target
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2124
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2125
Documentation:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2126
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2127
* remove license warnings about mbedTLS linking (README.mbedtls)
2128
* update documentation references in systemd unit files
2129
* sample config files: remove obsolete tls-*.conf files
2130
* document that auth-user-pass may be inlined
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2131
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2132
Windows MSI changes since 2.6.9:
2133
* For the Windows-specific security fixes see above
2134
* Built against OpenSSL 3.2.1
2135
* Included tap6-windows driver updated to 9.27.0
2136
* Security fix, see above
2137
* Included ovpn-dco-win driver updated to 1.0.1
2138
* Ensure we don't pass too large key size to CryptoNG. We do not consider this a security issue since the CryptoNG API handles this gracefully either way.
2139
* Included openvpn-gui updated to 11.48.0.0
2140
* Position tray tooltip above the taskbar
2141
* Combine title and message in tray icon tip text
2142
* Use a custom tooltip window for the tray icon
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2143
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2144
Note: Windows MSI was updated to I002 on April 15th. Changes in I002:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2145
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2146
* Update include ovpn-dco-win to v1.1.1
2147
* Improves reconnect behavior after hibernate/standby. (Github: [#64](https://github.com/OpenVPN/ovpn-dco-win/issues/64))
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2148
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2149
Note: Windows MSI was updated to I003 on May 23rd. Changes in I003:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2150
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2151
* Update include ovpn-dco-win to v1.2.1
2152
* Fix bug check in timer management routines. (Github: [#70](https://github.com/OpenVPN/ovpn-dco-win/issues/70))
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2153
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2154
| | | |
2155
|-|-|-|
2156
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.10-I003-amd64.msi.asc)|[OpenVPN-2.6.10-I003-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.10-I003-amd64.msi)|
2157
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.10-I003-arm64.msi.asc)|[OpenVPN-2.6.10-I003-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.10-I003-arm64.msi)|
2158
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.10-I003-x86.msi.asc)|[OpenVPN-2.6.10-I003-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.10-I003-x86.msi)|
2159
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.10.tar.gz.asc)|[openvpn-2.6.10.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.10.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2160
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2161
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2162
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2163
## OpenVPN 2.6.9 -- Released 12 February 2024
2164
The OpenVPN community project team is proud to release OpenVPN 2.6.9. This is a bugfix release containing one security fix for the Windows installer.
2165
2166
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.9/Changes.rst)
2167
2168
Security fixes:
2169
021418 novaflash 2025-07-02 12:28:58 2170
* Windows Installer: fix [CVE-2023-7235](https://www.cve.org/CVERecord?id=CVE-2023-7235) where installing to a non-default
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2171
directory could lead to a local privilege escalation. Reported by Will Dormann.
2172
2173
New features:
2174
2175
* Add support for building with mbedTLS 3.x.x
2176
* New option `--force-tls-key-material-export` to only accept clients
2177
that can do TLS keying material export to generate session keys
2178
(mostly an internal option to better deal with TLS 1.0 PRF failures).
2179
* Windows: bump vcpkg-ports/pkcs11-helper to 1.30
2180
* Log incoming SSL alerts in easier to understand form and move logging
2181
from `--verb 8` to `--verb 3`.
2182
* protocol_dump(): add support for printing `--tls-crypt` packets
2183
2184
User visible changes:
2185
2186
* License change is now complete, and all code has been re-licensed
2187
under the new license (still GPLv2, but with new linking exception
2188
for Apache2 licensed code). See [COPYING](https://github.com/OpenVPN/openvpn/blob/release/2.6/COPYING) for details.
2189
2190
Code that could not be re-licensed has been removed or rewritten.
2191
* The original code for the `--tls-export-cert` feature has been removed
2192
(due to the re-licensing effort) and rewritten without looking at the
2193
original code. Feature-compatibility has been tested by other developers,
2194
looking at both old and new code and documentation, so there *should*
2195
not be a user-visible change here.
2196
* IPv6 route addition/deletion are now logged on the same level (3) as
2197
for IPv4. Previously IPv6 was always logged at `--verb 1`.
2198
* Better handling of TLS 1.0 PRF failures in the underlying SSL library
2199
(e.g. on some FIPS builds) - this is now reported on startup, and
2200
clients before 2.6.0 that can not use TLS EKM to generate key material
2201
are rejected by the server. Also, error messages are improved to see
2202
what exactly failed.
2203
2204
Notable bug fixes:
2205
2206
* FreeBSD: for servers with multiple clients, reporting of peer traffic
2207
statistics would fail due to insufficient buffer space (Github: [#487](https://github.com/OpenVPN/openvpn/issues/487))
2208
2209
Windows MSI changes since 2.6.8:
2210
* Security fix, see above
2211
* Built against OpenSSL 3.2.0
2212
* Included openvpn-gui updated to 11.47.0.0
2213
* Windows GUI: always update tray icon on state change (Github: [#669](https://github.com/OpenVPN/openvpn-gui/issues/669))
2214
(for persistent connection profiles, "connecting" state would not show)
2215
2216
| | | |
2217
|-|-|-|
2218
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.9-I001-amd64.msi.asc)|[OpenVPN-2.6.9-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.9-I001-amd64.msi)|
2219
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.9-I001-arm64.msi.asc)|[OpenVPN-2.6.9-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.9-I001-arm64.msi)|
2220
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.9-I001-x86.msi.asc)|[OpenVPN-2.6.9-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.9-I001-x86.msi)|
2221
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.9.tar.gz.asc)|[openvpn-2.6.9.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.9.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2222
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2223
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2224
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2225
## OpenVPN 2.6.8 -- Released 17 November 2023
2226
The OpenVPN community project team is proud to release OpenVPN 2.6.8. This is a small bugfix release fixing a few regressions in 2.6.7 release.
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2227
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2228
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.8/Changes.rst)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2229
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2230
User visible changes:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2231
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2232
* Windows: print warning if pushed options require DHCP (e.g. DOMAIN-SEARCH)
2233
and driver in use does not use DHCP (wintun, dco).
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2234
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2235
Bug fixes:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2236
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2237
* SIGSEGV crash: Do not check key_state buffers that are in S_UNDEF state
2238
(Github [#449](https://github.com/OpenVPN/openvpn/issues/449)) - the new sanity check function introduced in 2.6.7
2239
sometimes tried to use a NULL pointer after an unsuccessful TLS handshake
2240
* Windows: `--dns` option did not work when tap-windows6 driver was used,
2241
because internal flag for "apply DNS option to DHCP server" wasn't set
2242
(Github [#447](https://github.com/OpenVPN/openvpn/issues/447))
2243
* Windows: fix status/log file permissions, caused by regression after
2244
changing to CMake build system (Github: [#454](https://github.com/OpenVPN/openvpn/issues/454), Trac: [#1430](https://community.openvpn.net/openvpn/ticket/1430))
2245
* Windows: fix `--chdir` failures, also caused by error in CMake build system
2246
(Github [#448](https://github.com/OpenVPN/openvpn/issues/448))
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2247
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2248
Windows MSI changes since 2.6.7:
2249
* Included openvpn-gui updated to 11.46.0.0
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2250
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2251
| | | |
2252
|-|-|-|
2253
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.8-I001-amd64.msi.asc)|[OpenVPN-2.6.8-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.8-I001-amd64.msi)|
2254
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.8-I001-arm64.msi.asc)|[OpenVPN-2.6.8-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.8-I001-arm64.msi)|
2255
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.8-I001-x86.msi.asc)|[OpenVPN-2.6.8-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.8-I001-x86.msi)|
2256
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.8.tar.gz.asc)|[openvpn-2.6.8.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.8.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2257
2258
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
2259
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2260
## OpenVPN 2.6.7 -- Released 09 November 2023
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2261
The OpenVPN community project team is proud to release OpenVPN 2.6.7. This is a bugfix release containing security fixes.
2262
2263
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.7/Changes.rst)
2264
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2265
Security Fixes:
2266
021418 novaflash 2025-07-02 12:28:58 2267
* [CVE-2023-46850](https://www.cve.org/CVERecord?id=CVE-2023-46850) OpenVPN versions between 2.6.0 and 2.6.6 incorrectly use a send buffer after it has been free()d in some circumstances, causing some free()d memory to be sent to the peer. All configurations using TLS (e.g. not using --secret) are affected by this issue. (found while tracking down CVE-2023-46849 / Github [#400](https://github.com/OpenVPN/openvpn/issues/400), [#417](https://github.com/OpenVPN/openvpn/issues/417))
2268
* [CVE-2023-46849](https://www.cve.org/CVERecord?id=CVE-2023-46849) OpenVPN versions between 2.6.0 and 2.6.6 incorrectly restore `--fragment` configuration in some circumstances, leading to a division by zero when `--fragment` is used. On platforms where division by zero is fatal, this will cause an OpenVPN crash.
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2269
(Github [#400](https://github.com/OpenVPN/openvpn/issues/400), [#417](https://github.com/OpenVPN/openvpn/issues/417)).
2270
2271
User visible changes:
2272
2273
* DCO: warn if DATA_V1 packets are sent by the other side - this a hard
2274
incompatibility between a 2.6.x client connecting to a 2.4.0-2.4.4 server,
2275
and the only fix is to use `--disable-dco`.
2276
* Remove OpenSSL Engine method for loading a key. This had to be removed
2277
because the original author did not agree to relicensing the code with
2278
the new linking exception added. This was a somewhat obsolete feature
2279
anyway as it only worked with OpenSSL 1.x, which is end-of-support.
2280
* add warning if p2p NCP client connects to a p2mp server - this is a
2281
combination that used to work without cipher negotiation (pre 2.6 on
2282
both ends), but would fail in non-obvious ways with 2.6 to 2.6.
2283
* add warning to `--show-groups` that not all supported groups are listed
2284
(this is due the internal enumeration in OpenSSL being a bit weird,
2285
omitting X448 and X25519 curves).
2286
* `--dns`: remove support for `exclude-domains` argument
2287
(this was a new 2.6 option, with no backend support implemented yet
2288
on any platform, and it turns out that no platform supported it at all -
2289
so remove option again)
2290
* warn user if INFO control message too long, do not forward to management
2291
client (safeguard against protocol-violating server implementations)
2292
2293
New features:
2294
2295
* DCO-WIN: get and log driver version (for easier debugging).
2296
* print "peer temporary key details" in TLS handshake
2297
* log OpenSSL errors on failure to set certificate, for example if the
2298
algorithms used are in acceptable to OpenSSL (misleading message would
2299
be printed in cryptoapi / pkcs11 scenarios)
2300
* add CMake build system for MinGW and MSVC builds
2301
* remove old MSVC build system
2302
* improve cmocka unit test building for Windows
2303
2304
Windows MSI changes since 2.6.6:
2305
* Included openvpn-gui updated to 11.45.0.0
2306
* Add clarity for error on missing management parameter.
2307
See GH [#657](https://github.com/OpenVPN/openvpn-gui/issues/657)
2308
* Improve "OpenVPN GUI" tooltip handling
2309
See GH [#649](https://github.com/OpenVPN/openvpn-gui/issues/649)
2310
* MSIs now use OpenSSL 3.1.4
2311
2312
| | | |
2313
|-|-|-|
2314
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.7-I001-amd64.msi.asc)|[OpenVPN-2.6.7-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.7-I001-amd64.msi)|
2315
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.7-I001-arm64.msi.asc)|[OpenVPN-2.6.7-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.7-I001-arm64.msi)|
2316
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.7-I001-x86.msi.asc)|[OpenVPN-2.6.7-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.7-I001-x86.msi)|
2317
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.7.tar.gz.asc)|[openvpn-2.6.7.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.7.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2318
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2319
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2320
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2321
## OpenVPN 2.6.6 -- Released 15 August 2023
2322
The OpenVPN community project team is proud to release OpenVPN 2.6.6. This is a small bugfix release.
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2323
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2324
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.6/Changes.rst)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2325
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2326
User visible changes:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2327
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2328
* OCC exit messages are now logged more visibly
2329
See GH [#391](https://github.com/OpenVPN/openvpn/issues/391).
2330
* OpenSSL error messages are now logged with more details (for example,
2331
when loading a provider fails, which .so was tried, and why did it fail)
2332
See GH [#361](https://github.com/OpenVPN/openvpn/issues/361).
2333
* print a more user-friendly message when tls-crypt-v2 client auth fails
2334
* packaging now includes all documentation in the source tarball
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2335
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2336
New features:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2337
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2338
* set WINS server via interactive service - this adds support for
2339
"dhcp-option WINS 192.0.2.1" for DCO + wintun interfaces where no
2340
DHCP server is used.
2341
See GH [#373](https://github.com/OpenVPN/openvpn/issues/373).
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2342
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2343
Windows MSI changes since 2.6.5:
2344
* Included openvpn-gui updated to 11.44.0.0
2345
* MSIs now use OpenSSL 3.1.2
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2346
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2347
| | | |
2348
|-|-|-|
2349
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.6-I001-amd64.msi.asc)|[OpenVPN-2.6.6-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.6-I001-amd64.msi)|
2350
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.6-I001-arm64.msi.asc)|[OpenVPN-2.6.6-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.6-I001-arm64.msi)|
2351
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.6-I001-x86.msi.asc)|[OpenVPN-2.6.6-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.6-I001-x86.msi)|
2352
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.6.tar.gz.asc)|[openvpn-2.6.6.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.6.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2353
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2354
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2355
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2356
## OpenVPN 2.6.5 -- Released 13 June 2023
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2357
The OpenVPN community project team is proud to release OpenVPN 2.6.5. This is a small bugfix release.
2358
2359
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.5/Changes.rst)
2360
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2361
User visible changes:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2362
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2363
* tapctl (windows): generate driver-specific names (if using tapctl to
2364
create additional tap/wintun/dco devices, and not using --name).
2365
See GH [#337](https://github.com/OpenVPN/openvpn/issues/337).
2366
* interactive service (windows): do not force target desktop for
2367
openvpn.exe - this has no impact for normal use, but enables running
2368
of OpenVPN in a scripted way when no user is logged on (for example,
2369
via task scheduler).
2370
See GH [openvpn-gui#626](https://github.com/OpenVPN/openvpn-gui/issues/626)
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2371
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2372
Windows MSI changes since 2.6.4:
2373
* MSIs now use OpenSSL 3.1.1
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2374
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2375
Debian/Ubuntu packages in OpenvpnSoftwareRepos are now available for arm64.
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2376
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2377
| | | |
2378
|-|-|-|
2379
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.5-I001-amd64.msi.asc)|[OpenVPN-2.6.5-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.5-I001-amd64.msi)|
2380
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.5-I001-arm64.msi.asc)|[OpenVPN-2.6.5-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.5-I001-arm64.msi)|
2381
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.5-I001-x86.msi.asc)|[OpenVPN-2.6.5-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.5-I001-x86.msi)|
2382
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.5.tar.gz.asc)|[openvpn-2.6.5.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.5.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2383
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2384
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2385
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2386
## OpenVPN 2.6.4 -- Released 11 May 2023
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2387
The OpenVPN community project team is proud to release OpenVPN 2.6.4. This is a small bugfix release.
2388
2389
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.4/Changes.rst)
2390
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2391
Note:
2392
* **License amendment**: all **new** commits fall under a modified license that
2393
explicitly permits linking with Apache2 libraries (mbedTLS, OpenSSL) -
2394
see COPYING for details. Existing code will fall under the new license
2395
as soon as all contributors have agreed to the change - work ongoing.
2396
2397
Feature changes:
2398
* DCO: support kernel-triggered key rotation (avoid IV reuse after 2^32^
2399
packets). This is the userland side, accepting a message from kernel,
2400
and initiating a TLS renegotiation. As of 2.6.4 release, only implemented in
2401
FreeBSD kernel.
2402
2403
Windows MSI changes since 2.6.3:
2404
* Rebuilt included tap-windows driver with the correct version of the old Windows 7 driver, removing a warning about unsigned driver on Windows 7 installation.
2405
See GH [openvpn-build#365](https://github.com/OpenVPN/openvpn-build/issues/365).
2406
2407
| | | |
2408
|-|-|-|
2409
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.4-I001-amd64.msi.asc)|[OpenVPN-2.6.4-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.4-I001-amd64.msi)|
2410
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.4-I001-arm64.msi.asc)|[OpenVPN-2.6.4-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.4-I001-arm64.msi)|
2411
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.4-I001-x86.msi.asc)|[OpenVPN-2.6.4-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.4-I001-x86.msi)|
2412
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.4.tar.gz.asc)|[openvpn-2.6.4.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.4.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2413
2414
For Community-maintained packages for Linux distributions see OpenvpnSoftwareRepos
2415
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2416
## OpenVPN 2.6.3 -- Released 13 April 2023
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2417
The OpenVPN community project team is proud to release OpenVPN 2.6.3. This is a small bugfix release.
2418
2419
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.3/Changes.rst)
2420
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2421
Feature changes:
2422
* Windows: support setting DNS domain in configurations without GUI and DHCP (typically wintun or windco drivers), see GH [openvpn#306](https://github.com/OpenVPN/openvpn/issues/306).
2423
2424
Windows MSI changes since 2.6.2:
2425
* Several Windows-specific issues fixed:
2426
* ensure interactive service stays enabled after silent reinstall, see GH [openvpn-build#348](https://github.com/OpenVPN/openvpn-build/issues/348), [openvpn-build#349](https://github.com/OpenVPN/openvpn-build/issues/349) and [openvpn-build#351](https://github.com/OpenVPN/openvpn-build/issues/351)
2427
* repair querying install path info for easyrsa-start.bat on some Windows language versions, see GH [openvpn-build#352](https://github.com/OpenVPN/openvpn-build/issues/352).
2428
* MSIs are now built against OpenSSL 3.1.0.
2429
* Update included openvpn-gui to 11.41.0.0
2430
* This update removes the ability to change the password of a private key from the GUI. This was a niche feature which caused a direct dependency of
2431
GUI on OpenSSL. Use openssl.exe directly if you need to edit a private key.
2432
2433
Note: Windows MSI was updated to I002 on April 26th. Changes in I002:
2434
* The GPG subkey for creating the .asc files for the downloads has been updated. You might need to re-download or update the GPG key if verifying the signatures.
2435
* Fix the encoding of some documentation/sample files included in the installer. See GH [openvpn-build#358](https://github.com/OpenVPN/openvpn-build/issues/358)
2436
* Update include tap-windows6 driver to 9.25.0
2437
* Fixes a problem with sending small non-IP packets (e.g. PPPoE) over the VPN connection. See GH [tap-windows6#158](https://github.com/OpenVPN/tap-windows6/issues/158)
2438
* Fixes occasional TCP performance degradation on Windows Server 2022 See GH [tap-windows6#147](https://github.com/OpenVPN/tap-windows6/pull/147)
2439
* Note: The new driver is only used on Windows 10 and newer. We can't rebuild drivers for Windows 7/8 since Microsoft doesn't support the signing mechanism anymore. We include the previous driver version to still allow installation on Windows 7/8.
2440
* Update included openvpn-gui to 11.42.0.0
2441
* Fixes a problem with passphrase prompt was sometimes not displayed. See GH [openvpn-gui#619](https://github.com/OpenVPN/openvpn-gui/issues/619)
2442
* Adds "Password Reveal" feature which allows you to see passwords while entering them.
2443
2444
Note: Windows MSI was updated to I003 on April 27th. Changes in I003:
2445
* Update include tap-windows6 driver to 9.26.0
2446
* Revert fix for occasional TCP performance degradation on Windows Server 2022 (GH [tap-windows6#147](https://github.com/OpenVPN/tap-windows6/pull/147)) since users reported BSODs in some (undetermined) scenarios.
2447
2448
| | | |
2449
|-|-|-|
2450
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.3-I003-amd64.msi.asc)|[OpenVPN-2.6.3-I003-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.3-I003-amd64.msi)|
2451
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.3-I003-arm64.msi.asc)|[OpenVPN-2.6.3-I003-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.3-I003-arm64.msi)|
2452
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.3-I003-x86.msi.asc)|[OpenVPN-2.6.3-I003-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.3-I003-x86.msi)|
2453
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.3.tar.gz.asc)|[openvpn-2.6.3.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.3.tar.gz)|
2454
2455
## OpenVPN 2.6.2 -- Released 24 March 2023
2456
The OpenVPN community project team is proud to release OpenVPN 2.6.2. This is mostly a bugfix release with some improvements.
2457
2458
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.2/Changes.rst)
2459
2460
Feature changes:
2461
* implement byte counter statistics for DCO Linux (p2mp server and client)
2462
* implement byte counter statistics for DCO Windows (client only)
2463
* `--dns server <n> address ...` now permits up to 8 v4 or v6 addresses
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2464
2465
**Important note for Linux DCO users**:
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2466
* New control packets flow for data channel offloading on Linux:
2467
2.6.2+ changes the way OpenVPN control packets are handled on
2468
Linux when DCO is active, fixing the lockups observed with 2.6.0/2.6.1
2469
under high client connect/disconnect activity.
2470
This is an **INCOMPATIBLE** change and therefore an ovpn-dco kernel
2471
module older than v0.2.20230323 (commit ID 726fdfe0fa21) will not
2472
work anymore and must be upgraded. The kernel module was renamed to
2473
"ovpn-dco-v2.ko" in order to highlight this change and ensure that
2474
users and userspace software could easily understand which version
2475
is loaded. Attempting to use the old ovpn-dco with 2.6.2+ will
2476
lead to disabling DCO at runtime.
2477
2478
Windows MSI changes since 2.6.1:
2479
* Update included openvpn-gui to 11.39.0.0
2480
2481
| | | |
2482
|-|-|-|
2483
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.2-I001-amd64.msi.asc)|[OpenVPN-2.6.2-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.2-I001-amd64.msi)|
2484
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.2-I001-arm64.msi.asc)|[OpenVPN-2.6.2-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.2-I001-arm64.msi)|
2485
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.2-I001-x86.msi.asc)|[OpenVPN-2.6.2-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.2-I001-x86.msi)|
2486
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.2.tar.gz.asc)|[openvpn-2.6.2.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.2.tar.gz)|
2487
2488
## OpenVPN 2.6.1 -- Released 8 March 2023
2489
The OpenVPN community project team is proud to release OpenVPN 2.6.1. This is mostly a bugfix release with some improvements.
2490
2491
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.1/Changes.rst)
2492
2493
Feature changes:
2494
* Dynamic TLS Crypt:
2495
When both peers are OpenVPN 2.6.1+, OpenVPN will dynamically create
2496
a tls-crypt key that is used for renegotiation. This ensure that only the
2497
previously authenticated peer can do trigger renegotiation and complete
2498
renegotiations.
2499
* CryptoAPI (Windows): support issuer name as a selector.
2500
Certificate selection string can now specify a partial
2501
issuer name string as "--cryptoapicert ISSUER:<string>" where
2502
<string> is matched as a substring of the issuer (CA) name in
2503
the certificate.
2504
2505
Note: configure now enables DCO build by default on FreeBSD and Linux. On Linux
2506
this brings in a new default dependency for libnl-genl (for Linux distributions
2507
that are too old to have a suitable version of the library, use "configure --disable-dco")
2508
2509
Windows MSI changes since 2.6.0:
2510
* Update included ovpn-dco-win driver to 0.9.2
2511
2512
| | | |
2513
|-|-|-|
2514
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.1-I001-amd64.msi.asc)|[OpenVPN-2.6.1-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.1-I001-amd64.msi)|
2515
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.1-I001-arm64.msi.asc)|[OpenVPN-2.6.1-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.1-I001-arm64.msi)|
2516
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.1-I001-x86.msi.asc)|[OpenVPN-2.6.1-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.1-I001-x86.msi)|
2517
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.1.tar.gz.asc)|[openvpn-2.6.1.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.1.tar.gz)|
2518
2519
## OpenVPN 2.5.9 -- Released 15 February 2023
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2520
The OpenVPN community project team is proud to release OpenVPN 2.5.9. This is a small bugfix release.
2521
2522
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.5.9/Changes.rst)
2523
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2524
Windows MSI changes since 2.5.8:
2525
* Build against OpenSSL 1.1.1t which contains several security fixes.
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2526
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2527
| | | |
2528
|-|-|-|
2529
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.9-I601-amd64.msi.asc)|[OpenVPN-2.5.9-I601-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.9-I601-amd64.msi)|
2530
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.9-I601-arm64.msi.asc)|[OpenVPN-2.5.9-I601-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.9-I601-arm64.msi)|
2531
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.9-I601-x86.msi.asc)|[OpenVPN-2.5.9-I601-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.5.9-I601-x86.msi)|
2532
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.5.9.tar.gz.asc)|[openvpn-2.5.9.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.5.9.tar.gz)|
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2533
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2534
## OpenVPN 2.6.0 -- Released 25 January 2023
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2535
The OpenVPN community project team is proud to release OpenVPN 2.6.0. This is a release with some major new features.
2536
2537
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.0/Changes.rst)
2538
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2539
Changes since RC2:
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2540
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2541
* Various bugfixes, see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.0/Changes.rst)
2542
2543
Windows MSI changes since RC2:
2544
* Included openvpn-gui updated to 11.37.0.0. See [CHANGES.rst](https://github.com/OpenVPN/openvpn-gui/blob/v11.37.0.0/CHANGES.rst).
2545
* DCO driver is now included as a installer module (msm) so that other products (like OpenVPN Connect) can share the DCO installation.
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2546
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2547
Note: Windows MSI was updated to I003 on January 26th. Changes in I003:
2548
* Fix installation on Windows 7
2549
* Fix broken tray icon menu with single profile (regression in openvpn-gui 11.36.0)
2550
2551
Note: Windows MSI was updated to I004 on February 6th. Changes in I004:
2552
* Update included ovpn-dco-win driver to 0.9.0. Fixes an issue that breaks Windows boot on some machines. See [OpenVPN/ovpn-dco-win#24](https://github.com/OpenVPN/ovpn-dco-win/issues/24).
2553
* Update included easy-rsa to 3.1.2
2554
2555
Note: Windows MSI was updated to I005 on February 15th. Changes in I005:
2556
* Update included ovpn-dco-win driver to 0.9.1.
2557
* Fixes an potential crash on machines that use "legacy standby" (S3). See [OpenVPN/ovpn-dco-win#36](https://github.com/OpenVPN/ovpn-dco-win/issues/36).
2558
* Fixes an incompatibility of DCO driver with Citrix DNE Lightweight Filter. See [OpenVPN/ovpn-dco-win#31](https://github.com/OpenVPN/ovpn-dco-win/issues/31).
2559
* Built against OpenSSL 3.0.8 which includes several security fixes.
2560
2561
New features and improvements in 2.6.0 compared to 2.5.8:
2562
2563
* Data Channel Offload (DCO) kernel acceleration support for Windows, Linux, and FreeBSD.
2564
* OpenSSL 3 support, which is now the default on Windows.
2565
* Improved handling of tunnel MTU, including support for pushable MTU.
2566
* Outdated cryptographic algorithms disabled by default, but there are options to override if necessary.
2567
* Reworked TLS handshake, making OpenVPN immune to replay-packet state exhaustion attacks.
2568
* Added --peer-fingerprint mode for a more simplistic certificate setup and verification.
2569
* Added Pre-Logon Access Provider support to OpenVPN GUI for Windows.
2570
* Improved protocol negotiation, leading to faster connection setup.
2571
* Updated easy-rsa3 bundled with the installer on Windows.
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2572
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2573
On Windows DCO will be used by default for client connections unless the configuration contains settings that are not DCO compatible, such as compression. DCO support on Linux requires an additional kernel module to be installed, this is available from our [OpenvpnSoftwareRepos software repositories for Linux], and is also available for OpenVPN3 Linux client.
2574
2575
| | | |
2576
|-|-|-|
2577
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.0-I005-amd64.msi.asc)|[OpenVPN-2.6.0-I005-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.0-I005-amd64.msi)|
2578
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.0-I005-arm64.msi.asc)|[OpenVPN-2.6.0-I005-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.0-I005-arm64.msi)|
2579
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.0-I005-x86.msi.asc)|[OpenVPN-2.6.0-I005-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6.0-I005-x86.msi)|
2580
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6.0.tar.gz.asc)|[openvpn-2.6.0.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6.0.tar.gz)|
2581
2582
## OpenVPN 2.6_rc2 -- Released 12 January 2023
2583
The OpenVPN community project team is proud to release OpenVPN 2.6_rc2. This is a release with some major new features and currently in beta (you can also download the [stable release](https://openvpn.net/community-downloads) should you require it).
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2584
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2585
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6_rc2/Changes.rst)
2586
2587
Changes since RC1:
2588
2589
* add rate limiter for incoming "initial handshake packets", enabled by
2590
default with a limit of 100 packets per 10 seconds. This change makes
2591
OpenVPN servers uninteresting as an UDP reflection DDoS engine.
2592
* report `CONNECTED,ROUTE_ERROR` to management GUI if connection to
2593
server succeeds but not all routes can be installed (Windows and
2594
!Linux/Netlink only, so far)
2595
* Various bugfixes, see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6_rc2/Changes.rst)
2596
2597
Windows MSI changes since RC1:
2598
* Included openvpn-gui updated to 11.35.0.0. See [CHANGES.rst](https://github.com/OpenVPN/openvpn-gui/blob/v11.35.0.0/CHANGES.rst).
2599
* New feature: Support the `CONNECTED,ROUTE_ERROR` management message (see above)
2600
* Fix some issues related to upgrading:
2601
* "Run on logon" option not preserved when updating from 2.5 to 2.6
2602
* Fix check for running service when upgrading from old NSIS installations
2603
2604
Debian packages changes since RC1:
2605
* Packages for Debian bookworm are now available.
2606
2607
New features and improvements in 2.6.0 compared to 2.5.8:
2608
2609
* Data Channel Offload (DCO) kernel acceleration support for Windows, Linux, and FreeBSD.
2610
* OpenSSL 3 support, which is now the default on Windows.
2611
* Improved handling of tunnel MTU, including support for pushable MTU.
2612
* Outdated cryptographic algorithms disabled by default, but there are options to override if necessary.
2613
* Reworked TLS handshake, making OpenVPN immune to replay-packet state exhaustion attacks.
2614
* Added --peer-fingerprint mode for a more simplistic certificate setup and verification.
2615
* Added Pre-Logon Access Provider support to OpenVPN GUI for Windows.
2616
* Improved protocol negotiation, leading to faster connection setup.
2617
* Updated easy-rsa3 bundled with the installer on Windows.
2618
2619
On Windows DCO will be used by default for client connections unless the configuration contains settings that are not DCO compatible, such as compression. DCO support on Linux requires an additional kernel module to be installed, this is available from our [OpenvpnSoftwareRepos software repositories for Linux], and is also available for OpenVPN3 Linux client.
2620
2621
| | | |
2622
|-|-|-|
2623
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc2-I002-amd64.msi.asc)|[OpenVPN-2.6_rc2-I002-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc2-I002-amd64.msi)|
2624
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc2-I002-arm64.msi.asc)|[OpenVPN-2.6_rc2-I002-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc2-I002-arm64.msi)|
2625
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc2-I002-x86.msi.asc)|[OpenVPN-2.6_rc2-I002-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc2-I002-x86.msi)|
2626
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6_rc2.tar.gz.asc)|[openvpn-2.6_rc2.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6_rc2.tar.gz)|
2627
2628
## OpenVPN 2.6_rc1 -- Released 28 December 2022
2629
The OpenVPN community project team is proud to release OpenVPN 2.6_rc1. This is a release with some major new features and currently in beta (you can also download the [stable release](https://openvpn.net/community-downloads) should you require it).
2630
2631
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6_rc1/Changes.rst)
2632
2633
Changes since Beta 2:
2634
2635
* Officially deprecate NTLMv1 proxy auth method in 2.6. Will be removed in 2.7.
2636
* Support unlimited number of connection entries and remote entries.
2637
* New management commands to enumerate and list remote entries.
2638
* Various bugfixes, see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6_rc1/Changes.rst)
2639
2640
Windows MSI changes since Beta 2:
2641
* Included openvpn-gui updated to 11.34.0.0. See [CHANGES.rst](https://github.com/OpenVPN/openvpn-gui/blob/v11.34.0.0/CHANGES.rst).
2642
* New feature: Connections active on exit/logout are now automatically restarted in the next session of the GUI
2643
* Windows installers are now built with Visual Studio 17 2022 (previously built with VS 16 2019)
2644
2645
New features and improvements in 2.6.0 compared to 2.5.8:
2646
2647
* Data Channel Offload (DCO) kernel acceleration support for Windows, Linux, and FreeBSD.
2648
* OpenSSL 3 support, which is now the default on Windows.
2649
* Improved handling of tunnel MTU, including support for pushable MTU.
2650
* Outdated cryptographic algorithms disabled by default, but there are options to override if necessary.
2651
* Reworked TLS handshake, making OpenVPN immune to replay-packet state exhaustion attacks.
2652
* Added --peer-fingerprint mode for a more simplistic certificate setup and verification.
2653
* Added Pre-Logon Access Provider support to OpenVPN GUI for Windows.
2654
* Improved protocol negotiation, leading to faster connection setup.
2655
* Updated easy-rsa3 bundled with the installer on Windows.
2656
2657
On Windows DCO will be used by default for client connections unless the configuration contains settings that are not DCO compatible, such as compression. DCO support on Linux requires an additional kernel module to be installed, this is available from our [OpenvpnSoftwareRepos software repositories for Linux], and is also available for OpenVPN3 Linux client.
2658
2659
| | | |
2660
|-|-|-|
2661
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc1-I001-amd64.msi.asc)|[OpenVPN-2.6_rc1-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc1-I001-amd64.msi)|
2662
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc1-I001-arm64.msi.asc)|[OpenVPN-2.6_rc1-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc1-I001-arm64.msi)|
2663
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc1-I001-x86.msi.asc)|[OpenVPN-2.6_rc1-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_rc1-I001-x86.msi)|
2664
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6_rc1.tar.gz.asc)|[openvpn-2.6_rc1.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6_rc1.tar.gz)|
2665
2666
## OpenVPN 2.6_beta2 -- Released 15 December 2022
2667
The OpenVPN community project team is proud to release OpenVPN 2.6_beta2. This is a release with some major new features and currently in beta (you can also download the [stable release](https://openvpn.net/community-downloads) should you require it).
2668
2669
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6_beta2/Changes.rst)
2670
2671
Changes since Beta 1:
2672
2673
* Transport statistics (bytes in/out) for DCO environments. Currently only for Windows clients and FreeBSD servers. Other platforms will be fixed in next release.
2674
* Various bugfixes, see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6_beta2/Changes.rst)
2675
2676
Windows MSI changes since Beta 1:
2677
* Included openvpn-gui updated to 11.33.0.0. See [CHANGES.rst](https://github.com/OpenVPN/openvpn-gui/blob/v11.33.0.0/CHANGES.rst).
2678
* Update included pkcs11-helper so it can load pkcs11 providers from outside of its own install directory.
2679
* Add legacy provider for included OpenSSL so that the workarounds documented for old ciphers work on Windows.
2680
2681
New features and improvements in 2.6.0 compared to 2.5.8:
2682
2683
* Data Channel Offload (DCO) kernel acceleration support for Windows, Linux, and FreeBSD.
2684
* OpenSSL 3 support, which is now the default on Windows.
2685
* Improved handling of tunnel MTU, including support for pushable MTU.
2686
* Outdated cryptographic algorithms disabled by default, but there are options to override if necessary.
2687
* Reworked TLS handshake, making OpenVPN immune to replay-packet state exhaustion attacks.
2688
* Added --peer-fingerprint mode for a more simplistic certificate setup and verification.
2689
* Added Pre-Logon Access Provider support to OpenVPN GUI for Windows.
2690
* Improved protocol negotiation, leading to faster connection setup.
2691
* Updated easy-rsa3 bundled with the installer on Windows.
2692
2693
On Windows DCO will be used by default for client connections unless the configuration contains settings that are not DCO compatible, such as compression. DCO support on Linux requires an additional kernel module to be installed, this is available from our [OpenvpnSoftwareRepos software repositories for Linux], and is also available for OpenVPN3 Linux client.
2694
2695
| | | |
2696
|-|-|-|
2697
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta2-I001-amd64.msi.asc)|[OpenVPN-2.6_beta2-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta2-I001-amd64.msi)|
2698
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta2-I001-arm64.msi.asc)|[OpenVPN-2.6_beta2-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta2-I001-arm64.msi)|
2699
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta2-I001-x86.msi.asc)|[OpenVPN-2.6_beta2-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta2-I001-x86.msi)|
2700
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6_beta2.tar.gz.asc)|[openvpn-2.6_beta2.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6_beta2.tar.gz)|
2701
2702
## OpenVPN 2.6_beta1 -- Released 2 December 2022
2703
The OpenVPN community project team is proud to release OpenVPN 2.6_beta1. This is a release with some major new features and currently in beta (you may find [stable release](https://openvpn.net/community-downloads) should you require it).
c14e58 Samuli Seppänen 2025-02-11 07:05:53 2704
2705
For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6_beta1/Changes.rst)
2706
0f2d41 Samuli Seppänen 2025-02-12 13:37:02 2707
There were a number of new features and improvements:
2708
2709
* Data Channel Offload (DCO) kernel acceleration support for Windows, Linux, and FreeBSD.
2710
* OpenSSL 3 support, which is now the default on Windows.
2711
* Improved handling of tunnel MTU, including support for pushable MTU.
2712
* Outdated cryptographic algorithms disabled by default, but there are options to override if necessary.
2713
* Reworked TLS handshake, making OpenVPN immune to replay-packet state exhaustion attacks.
2714
* Added --peer-fingerprint mode for a more simplistic certificate setup and verification.
2715
* Added Pre-Logon Access Provider support to OpenVPN GUI for Windows.
2716
* Improved protocol negotiation, leading to faster connection setup.
2717
* Updated easy-rsa3 bundled with the installer on Windows.
2718
2719
On Windows DCO will be used by default for client connections unless the configuration contains settings that are not DCO compatible, such as compression. DCO support on Linux requires an additional kernel module to be installed, this is available from our [OpenvpnSoftwareRepos software repositories for Linux], and is also available for OpenVPN3 Linux client.
2720
2721
| | | |
2722
|-|-|-|
2723
|**Windows 64-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta1-I001-amd64.msi.asc)|[OpenVPN-2.6_beta1-I001-amd64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta1-I001-amd64.msi)|
2724
|**Windows ARM64 MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta1-I001-arm64.msi.asc)|[OpenVPN-2.6_beta1-I001-arm64.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta1-I001-arm64.msi)|
2725
|**Windows 32-bit MSI installer**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta1-I001-x86.msi.asc)|[OpenVPN-2.6_beta1-I001-x86.msi](https://swupdate.openvpn.org/community/releases/OpenVPN-2.6_beta1-I001-x86.msi)|
2726
|**Source archive file**|[GnuPG Signature](https://swupdate.openvpn.org/community/releases/openvpn-2.6_beta1.tar.gz.asc)|[openvpn-2.6_beta1.tar.gz](https://swupdate.openvpn.org/community/releases/openvpn-2.6_beta1.tar.gz)|