CVE-2026-13698 - Server memory leak via repeated tls-crypt-v2 HARD_RESET_CLIENT_V3 packets

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

CVE Record: CVE-2026-13698

Github:

• OpenVPN/openvpn-private-issues#137

Release notes:

• openvpn-2.7.5
• openvpn-2.6.21

Reported-By: Max Fillinger (maximilian.fillinger@sentyron.com)