CVE-2026-13117 – community wiki

# CVE-2026-13117 - Heap use-after-free via incomplete guard in check_session_buf_not_used()

An incomplete guard in the `check_session_buf_not_used()` function in OpenVPN 2.6.x and 2.7.x fails to account for aliases in `tls_wrap_reneg.work.data` when dynamic tls-crypt-v2 is active. This allows a remote authenticated peer to trigger a use-after-free condition during TLS session promotion, potentially resulting in a server crash (denial of service) or the leakage of sensitive heap memory to the network peer. This issue is a bypass of the fix for [CVE-2026-40215](../CVE-2026-40215).

Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. This is fixed in versions 2.6.21 and 2.7.5.

CVE Record: [CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117)

Github:
* [OpenVPN/openvpn-private-issues#119](https://github.com/OpenVPN/openvpn-private-issues/issues/119)
* [OpenVPN/openvpn-private-issues#131](https://github.com/OpenVPN/openvpn-private-issues/issues/131)

Release notes:
* [openvpn-2.7.5](https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026)
* [openvpn-2.6.21](https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026)

Reported-By: Trace37 Labs (@trace37labs)

Reported-By: Haiyang Huang (huanghaiyang83@gmail.com)