CVE-2026-13122
Description
A flaw was found in OpenVPN. A remote attacker can exploit this vulnerability by sending a malformed authentication token. This can trigger a reachable assertion when external authentication (external-auth) is enabled, leading to a Denial of Service (DoS) condition for the OpenVPN server.
Statement
A Moderate denial of service flaw exists in OpenVPN when configured with external-auth. Remote attackers can exploit this by sending a specially crafted authentication token, leading to a reachable assertion and service unavailability. This issue specifically impacts deployments where external authentication is enabled, increasing the attack surface.
Mitigation
To reduce exposure, disable the `external-auth` feature in OpenVPN if it is not required. This can be done by removing or commenting out the `external-auth` directive in the OpenVPN configuration file. If `external-auth` is necessary, restrict network access to the OpenVPN service to trusted clients through firewall rules. A restart of the OpenVPN service is required for configuration changes to take effect, which may temporarily disrupt active connections.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker's own session.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
