Blame
| 3dba6e | flichtenheld | 2026-07-23 14:41:46 | 1 | # CVE-2026-12996 - Potential DoS and memory leak via TLS session use-after-free |
| 600990 | David Sommerseth | 2026-06-23 14:32:32 | 2 | |
| 3dba6e | flichtenheld | 2026-07-23 14:41:46 | 3 | A use-after-free vulnerability in OpenVPN 2.x allows a remote authenticated peer to potentially cause a denial of service (server crash) or potentially leak sensitive heap memory. This occurs because certain per-session buffers, specifically ack_write_buf, are not properly guarded during TLS session promotion or when a session expires (TM_LAME_DUCK), leading to a shallow copy being sent after the session memory has been freed. This issue is caused by an incomplete fix for [CVE-2026-40215](../CVE-2026-40215). |
| 4 | ||||
| 5 | Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. This is fixed in versions 2.6.21 and 2.7.5. |
|||
| 6 | ||||
| 7 | CVE Record: [CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996) |
|||
| 8 | ||||
| 9 | Github: |
|||
| 10 | * [OpenVPN/openvpn-private-issues#121](https://github.com/OpenVPN/openvpn-private-issues/issues/121) |
|||
| 11 | * [OpenVPN/openvpn-private-issues#132](https://github.com/OpenVPN/openvpn-private-issues/issues/132) |
|||
| 12 | ||||
| 13 | Release notes: |
|||
| 14 | * [openvpn-2.7.5](https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026) |
|||
| 15 | * [openvpn-2.6.21](https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026) |
|||
| 16 | ||||
| 17 | Reported-By: Hcamael |
|||
| 18 | ||||
| 19 | Reported-By: 章鱼哥 (@aipy) (www.aipyaipy.com) |