VYPR
← All advisories
High severity8.1NVD Advisory· Published Jul 30, 2026· Updated Aug 5, 2026

CVE-2026-13117

CVE-2026-13117

Description

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage

Affected products

2
  • OpenVPN/OpenVPN2 versions
    cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*range: >=2.6.0,<2.6.21
    • (no CPE)range: 2.6.0 - 2.6.20, 2.7_alpha1 - 2.7.4

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.