Medium severity5.3NVD Advisory· Published Jul 6, 2026· Updated Jul 9, 2026

CVE-2026-13122

Description

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled

Affected products

OpenVPN/OpenVPN2 versions
cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*+ 1 more
- cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*range: >=2.6.0,<2.6.21
- (no CPE)range: 2.6.0-2.6.20, 2.7_alpha1-2.7.4
osv-coords2 versions
pkg:rpm/opensuse/openvpn&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/openvpn&distro=openSUSE%20Leap%2016.0
< 2.7.5-1.1+ 1 more
- (no CPE)range: < 2.7.5-1.1
- (no CPE)range: < 2.6.10-160000.4.1

Patches

Vulnerability mechanics

References

community.openvpn.net/Security%20Announcements/CVE-2026-13122nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000