The vulnerability identified as CVE-2026-13698 is a memory leak in OpenVPN affecting multiple version ranges: 2.5.0 to 2.5.11, 2.6.0 to 2.6.20, and 2.7_alpha1 to 2.7.4. Remote attackers with a valid tls-crypt-v2 client key can exploit this issue to cause a denial of service condition by triggering the memory leak. The vulnerability is categorized under CWE-401 (Improper Release of Memory). No known exploits in the wild have been reported, and no patch or official remediation information is currently provided.

Successful exploitation of this vulnerability can lead to denial of service by causing the OpenVPN server to leak memory, potentially exhausting system resources and disrupting service availability. The attack requires possession of a valid tls-crypt-v2 client key, limiting the attack surface to authorized clients.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor for updates from the OpenVPN project and consider restricting access to trusted clients only. No official patch or workaround is currently documented.