CVE-2026-13122

Name
CVE-2026-13122
Description
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security@openvpn.net https://community.openvpn.net/Security%20Announcements/CVE-2026-13122

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:* openvpn >= 2.6.0 < 2.6.21
cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:* openvpn >= 2.7 < 2.7.5

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openvpn edge-main 2.7.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openvpn edge-main 2.7.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.20-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.17-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.16-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.16-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.14-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.13-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.12-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.12-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.11-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.10-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.9-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.9-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.8-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.7-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.6-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.5-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.4-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.2-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn edge-main 2.6.0-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.24-main 2.7.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openvpn 3.24-main 2.7.3-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.23-main 2.6.20-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.23-main 2.6.16-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.22-main 2.6.20-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.22-main 2.6.16-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.22-main 2.6.14-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.22-main 2.6.11-r0 None possibly vulnerable
openvpn 3.22-main 2.6.7-r0 None possibly vulnerable
openvpn 3.21-main 2.6.20-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.21-main 2.6.16-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.21-main 2.6.14-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.21-main 2.6.12-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.21-main 2.6.11-r0 None possibly vulnerable
openvpn 3.21-main 2.6.7-r0 None possibly vulnerable
openvpn 3.20-main 2.6.20-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.20-main 2.6.16-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.20-main 2.6.11-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.20-main 2.6.10-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.20-main 2.6.7-r0 None possibly vulnerable
openvpn 3.19-main 2.6.16-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.19-main 2.6.11-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.19-main 2.6.8-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openvpn 3.19-main 2.6.7-r0 None possibly vulnerable