CVE-2026-12996 – community wiki

# CVE-2026-12996 - Potential DoS and memory leak via TLS session use-after-free

A use-after-free vulnerability in OpenVPN 2.x allows a remote authenticated peer to potentially cause a denial of service (server crash) or potentially leak sensitive heap memory. This occurs because certain per-session buffers, specifically ack_write_buf, are not properly guarded during TLS session promotion or when a session expires (TM_LAME_DUCK), leading to a shallow copy being sent after the session memory has been freed. This issue is caused by an incomplete fix for [CVE-2026-40215](../CVE-2026-40215).

Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. This is fixed in versions 2.6.21 and 2.7.5.

CVE Record: [CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996)

Github:
* [OpenVPN/openvpn-private-issues#121](https://github.com/OpenVPN/openvpn-private-issues/issues/121)
* [OpenVPN/openvpn-private-issues#132](https://github.com/OpenVPN/openvpn-private-issues/issues/132)

Release notes:
* [openvpn-2.7.5](https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026)
* [openvpn-2.6.21](https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026)

Reported-By: Hcamael

Reported-By: 章鱼哥 (@aipy) (www.aipyaipy.com)