Blame
| 8dd2ce | flichtenheld | 2026-07-23 15:08:24 | 1 | # CVE-2026-13379 - Windows interactive service DNS SearchList state pollution |
| 96285b | David Sommerseth | 2026-06-25 21:27:01 | 2 | |
| 8dd2ce | flichtenheld | 2026-07-23 15:08:24 | 3 | The DNS SearchList undo logic in the Windows interactive service in OpenVPN 2.x allows a malicious or compromised VPN server to cause persistent global DNS search list corruption or a denial of service (service crash) via a pushed search domain that is identical to or identical to an substring of a previously set search domain. |
| 4 | ||||
| 5 | Affects versions 2.7_alpha1 through 2.7.4. This is fixed in version 2.7.5. |
|||
| 6 | ||||
| 7 | CVE Record: [CVE-2026-13379](https://www.cve.org/CVERecord?id=CVE-2026-13379) |
|||
| 8 | ||||
| 9 | Github: |
|||
| 10 | * [OpenVPN/openvpn-private-issues#123](https://github.com/OpenVPN/openvpn-private-issues/issues/123) |
|||
| 11 | ||||
| 12 | Release notes: |
|||
| 13 | * [openvpn-2.7.5](https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026) |
|||
| 14 | ||||
| 15 | Reported-By: 章鱼哥 (www.aipyaipy.com) |