Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-30T16:42:03 openvpn: OpenVPN: Denial of Service due to memory leak in tls-crypt-v2 client key extraction 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-771

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

A flaw was found in OpenVPN. A memory leak in the `tls-crypt-v2` client key extraction allows remote attackers to cause a denial of service (DoS). By sending a flood of specially crafted packets, an attacker can exhaust the system's memory, making the service unavailable.

This vulnerability is rated as Important. A memory leak within the tls-crypt-v2 client key extraction mechanism of OpenVPN can be remotely triggered by an unauthenticated attacker. By sending a high volume of specially crafted packets, an attacker can exhaust system memory, leading to a denial of service for the OpenVPN service. This impact is significant due to the remote, unauthenticated nature of the attack. https://www.cve.org/CVERecord?id=CVE-2026-12932 https://nvd.nist.gov/vuln/detail/CVE-2026-12932 https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026 https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026 https://community.openvpn.net/Security%20Announcements/CVE-2026-12932