Blame
| 68d1aa | flichtenheld | 2026-07-23 13:29:12 | 1 | # CVE-2026-11771 - NTLM proxy auth stack off-by-one write |
| f9a70a | David Sommerseth | 2026-06-22 18:48:04 | 2 | |
| 68d1aa | flichtenheld | 2026-07-23 13:29:12 | 3 | OpenVPN 2.x allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server. |
| 4 | ||||
| f88b0d | flichtenheld | 2026-07-23 13:44:59 | 5 | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 are affected. This is fixed in versions 2.6.21 and 2.7.5. |
| ba101f | flichtenheld | 2026-07-23 13:32:20 | 6 | |
| 68d1aa | flichtenheld | 2026-07-23 13:29:12 | 7 | CVE Record: [CVE-2026-11771](https://www.cve.org/CVERecord?id=CVE-2026-11771) |
| 8 | ||||
| 9 | Github: |
|||
| 94fe64 | flichtenheld | 2026-07-23 13:33:11 | 10 | * [OpenVPN/openvpn-private-issues#116](https://github.com/OpenVPN/openvpn-private-issues/issues/116) |
| 68d1aa | flichtenheld | 2026-07-23 13:29:12 | 11 | |
| 12 | Release notes: |
|||
| 13 | * [openvpn-2.7.5](https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026) |
|||
| 14 | * [openvpn-2.6.21](https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026) |
|||
| 15 | ||||
| 16 | Reported-By: Tristan Madani (@TristanInSec) |