CVE-2026-13117 - Heap use-after-free via incomplete guard in check_session_buf_not_used()
An incomplete guard in the check_session_buf_not_used() function in OpenVPN 2.6.x and 2.7.x fails to account for aliases in tls_wrap_reneg.work.data when dynamic tls-crypt-v2 is active. This allows a remote authenticated peer to trigger a use-after-free condition during TLS session promotion, potentially resulting in a server crash (denial of service) or the leakage of sensitive heap memory to the network peer. This issue is a bypass of the fix for CVE-2026-40215.
Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. This is fixed in versions 2.6.21 and 2.7.5.
CVE Record: CVE-2026-13117
Github:
Release notes:
Reported-By: Trace37 Labs (@trace37labs)
Reported-By: Haiyang Huang (huanghaiyang83@gmail.com)