Blame
| 2c9bb6 | flichtenheld | 2026-07-08 13:58:48 | 1 | # CVE-2026-13117 - Heap use-after-free via incomplete guard in check_session_buf_not_used() |
| 40c759 | David Sommerseth | 2026-06-23 21:18:15 | 2 | |
| c17849 | flichtenheld | 2026-07-08 14:28:11 | 3 | An incomplete guard in the `check_session_buf_not_used()` function in OpenVPN 2.6.x and 2.7.x fails to account for aliases in `tls_wrap_reneg.work.data` when dynamic tls-crypt-v2 is active. This allows a remote authenticated peer to trigger a use-after-free condition during TLS session promotion, potentially resulting in a server crash (denial of service) or the leakage of sensitive heap memory to the network peer. This issue is a bypass of the fix for [CVE-2026-40215](../CVE-2026-40215). |
| 2c9bb6 | flichtenheld | 2026-07-08 13:58:48 | 4 | |
| 9879e9 | flichtenheld | 2026-07-23 14:06:42 | 5 | Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. This is fixed in versions 2.6.21 and 2.7.5. |
| a00b65 | flichtenheld | 2026-07-23 13:45:22 | 6 | |
| 2c9bb6 | flichtenheld | 2026-07-08 13:58:48 | 7 | CVE Record: [CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117) |
| 8 | ||||
| 9 | Github: |
|||
| 10 | * [OpenVPN/openvpn-private-issues#119](https://github.com/OpenVPN/openvpn-private-issues/issues/119) |
|||
| 11 | * [OpenVPN/openvpn-private-issues#131](https://github.com/OpenVPN/openvpn-private-issues/issues/131) |
|||
| 12 | ||||
| 13 | Release notes: |
|||
| 14 | * [openvpn-2.7.5](https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026) |
|||
| 15 | * [openvpn-2.6.21](https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026) |
|||
| 16 | ||||
| 2e5cd4 | flichtenheld | 2026-07-23 15:19:21 | 17 | Reported-By: Trace37 Labs (@trace37labs) |
| 2c9bb6 | flichtenheld | 2026-07-08 13:58:48 | 18 | |
| 19 | Reported-By: Haiyang Huang (huanghaiyang83@gmail.com) |