OpenVPN 2.7.9 -- Released 5 November 2026

The OpenVPN community project team is proud to release OpenVPN 2.7.9. This is a bugfix release fixing several security issues.

For details see Changes.md

Security fixes

• win32: restrict loading plugin dependencies (DLLs) to plugin, app and system directories.

• win32: run openvpn.exe from the interactive service at "high integrity level", that is, process memory of openvpn.exe and all its threads are protected from tampering. Signals/Events are still permitted.

• win32: openvpnserv: strictly filter user-defined environment variables before passing to openvpn.exe (CVE-2026-121720)

  (Issue found by Heiko Hund, tracked in Github: OpenVPN/openvpn-private-issues#186)

• win32: openvpnserv: make validation of openvpn command line more robust to invalid-quoting attacks (CVE-2026-115342)

• win32: openvpn.exe: change parsing of commandline to use the same function that the interactive service uses (CommandLineToArgvW()) (CVE-2026-115342)

  (Issues found by Heiko Hund, tracked in Github: OpenVPN/openvpn-private-issues#184)

Bug fixes

• Username/Password parsing from --auth-user-pass file (or inline) left parts of overlong usernames in the password field. Fix. (GH OpenVPN/openvpn#1140)

• win32: openvpnserv: fix memory leak for security descriptors

• win32: repair logging of errors in Windows tun_read_queue()

• win32: avoid accessing uninitialized structure data if GetInterfaceInfo() or GetPerAdapterInfo() fail

• win32: openvpnserv: avoid double free() if GetTokenInformation() fails

• win32: openvpnserv: avoid potential format-string issue on registry defaults

• win32: openvpnserv: repair error reporting on RegGetValueA() failures inside GetItfDnsServersV4()

• win32: openvpnserv: fix inet_ntop() return code check in GetItfDnsServersV6(), making it ignore DHCP-provided DNS servers.

• route: repair printing of ROUTE_GATEWAY/ROUTE6_GATEWAY info - the actual gateway handling was correct, just not printing anything anymore.

• config: check_file_access: fix --extra-certs access check

• win32: tun: free gc arena in windows_set_mtu() (mem leak in error path)

• route: close socket in Haiku get_default_gateway() (FD leak)

• win32: openvpnserv: skip conversion of empty domain names

• win32: cmake+mingw: don't prefix the event message DLL with lib (it was building 'libopenvpnservmsg.dll' instead of 'openvpnservmsg.dll')

• win32: pass the buffer size in bytes to get_openvpn_reg_value()

• PUSH_UPDATE server: free temporary options after sending message (memleak)

User-visible Changes

• Linux: set IFF_BACKPRESSURE on Linux (if available)

  This helps the kernel tun/tap to apply proper prioritization (qdisc etc) to incoming packets if userspace is slow to process them. Without the flag, the kernel would just drop everything.

• Management/GUI: Optionally indicate username in >PASSWORD '<UP_TYPE>' prompts

  If an openvpn config has a username set but no password, and OpenVPN wants to prompt for the password, the GUI could not see the username today and prompted for both. With this change, OpenVPN sends a hint to the management interface, so a GUI can pre-fill the username field, or only prompt for the password.

  This is only done if the management interface client announces support for it (compatibility level >= 6).

Code improvements/general hardening

• crypto_epoch: wipe key material with secure_memzero()

• do not look up "none" cipher in OpenSSL - this avoids leaving an "error" on the OpenSSL error stack, which can then later lead to spurious SSL error prints on CRL loading.

• Make CRL reload EOF detection independent of stale error queue entries (GH: OpenVPN/openvpn#1104)

• tls_crypt: fix handling of "cipher final output" (which is always empty on today's SSL libraries, so no impact today, but might not be in future)

• crypto: ASSERT() opt before first use in openvpn_decrypt_aead()

• auth_token: wipe the server secret key after loading it

• port-share: do not write journal file through symlinks or hardlinks (and also document how port-share directory should be set up) (GH OpenVPN/openvpn#1124)

• dns-updown: close first pipe if creating the second one fails (avoid leaking file descriptors on error)

• init: check parameters for NULL before strlen() in send_cc_message (not triggerable today)

• crypto_openssl: Clear PEM decoded key data before freeing it

• Increase the buffer size for alert-message in management user-pass query (so long usernames can be hinted towards the GUI)

• win32: openvpnserv: validate message size for dns/nrpt/wins handlers (GH: OpenVPN/openvpn#1129)

• win32: plugin: detect too long plugin paths on Windows

• win32: openvpnserv: null-terminate iface.name in address and route handlers (GH: OpenVPN/openvpn#1130)

Documentation improvements

• Fix numbering of examples in management-notes.txt

• Document "notify" as auth pending method

• Convert Changes.rst to Markdown (2.7)

Long-term code maintenance

• OpenSSL 4.1 compatibility: use ASN1_STRING_get_length() now, providing a fallback to ASN1_STRING_length() for older SSL libraries.

• Linux: sitnl: use RTM_SETLINK for updating existing interfaces (instead of RTM_NEWLINK)

• gen-sample-keys.sh: Don't apply server extensions to CSRs

• review all usages of strncpy() (change to strncpynt(), memcpy(), etc. where appropriate)

Windows MSI changes since 2.7.8-I001:

• Improve setting ACLs for non-"Program Files" installation directories. There were some configurations where the intended ACLs were not applied. (GH: OpenVPN/openvpn-build#1520)

  (Issue found by reifaa, tracked in Github: OpenVPN/openvpn-private-issues#185)

• Update included openvpn-gui to 11.67

  • Support username indication in communication with OpenVPN (see above). Prefills the username in prompt to user. (GH: OpenVPN/openvpn-gui#719)
  • Fix tray tooltip and popup positioning on non-primary monitors (GH: OpenVPN/openvpn-gui#836)
  • Improve Swedish translation (GH: OpenVPN/openvpn-gui#828)

For Community-maintained packages for Linux distributions see OpenVPN Software Repositories.

OpenVPN 2.6.23 -- Released 23 September 2026

The OpenVPN community project team is proud to release OpenVPN 2.6.23. This is a bugfix release fixing several security issues.

For details see Changes.rst

Security fixes:

• ssl: do not trust the peer's request to resend the wrapped client key

  Tracked in Github: OpenVPN/openvpn-private-issues#181

• reliability layer: avoid unbounded reliable TLS timeout, and ignore acks for packets that cannot be outstanding (CVE-2026-84732)

  Both reliability layer bugs found by Mark Bregman (Fox-IT), tracked in Github: OpenVPN/openvpn-private-issues#161

• improve on check_session_buf_not_used(), catch possible double-free in the lame duck case (CVE-2026-84471)

  Bug reported by Andreas Gabriel Berbescu, tracked in Github: OpenVPN/openvpn-private-issues#157, and by Haruki Oyama (Waseda University), tracked in OpenVPN/openvpn-private-issues#132

• windows: fix CreateProcess() command line quoting for characters that are special to cmd.exe, where a combination of validation script plus rogue CA could lead to misbehavior (CVE-2026-84256)

  Bug found by Clouditera Security, tracked in Github: OpenVPN/openvpn-private-issues#159

• windows: fix tapctl to always call netsh.exe with full path (as we do elsewhere) (CVE-2026-84226)

  Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2), tracked in Github: OpenVPN/openvpn-private-issues#164

• windows: don't use NULL DACL with system objects, namely the --service exit event and the netsh.exe guard semaphore. The old approach was prone to a local DoS where one user could interfere with other users' openvpn processes by blocking the netsh semaphore or sending events. This only affects setups not using the iservice, or using the automatic service to start/stop openvpn (CVE-2026-82312)

  Bug found by DEBRAJ BASAK, tracked in Github: OpenVPN/openvpn-private-issues#167

• dhcp (windows): fix off-by-one in write_dhcp_search_str() temp buffer guard - suitable DHCP options could lead to a single-byte overflow of a temp buffer (CVE-2026-81738)

  Bug found by Andre Kropp (Nexory) and ChinhNguyen, tracked in Github: OpenVPN/openvpn-private-issues#165

• openvpnserv (windows): detect and refuse sibling dirs in CheckConfigPath() (CVE-2026-81830)

  Bug found by Harshit Varu, tracked in Github: OpenVPN/openvpn-private-issues#166

Originally there was no Windows installer provided for 2.6.23. But we decided to provide one on October 7 to include the ovpn-dco-win security update.

Windows MSI changes since 2.6.22-I001:

• Update included dco-win driver to v1.3.4
  • CVE-2026-105390 — a locking flaw allowed a local user with access to the driver's device to cause a system deadlock and denial of service, hanging the host until it was power-cycled.
• Update included OpenSSL to 3.6.5

Full Release History