openvpn vulnerabilities (CVE-2026-11771)
It was discovered that OpenVPN had a 1-byte buffer overrun when handling NTLMv2 proxy responses. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-11771) It was discovered that OpenVPN incorrectly handled metadata when extracting tls-crypt-v2 client keys. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-12932) It was discovered that OpenVPN had a use-after-free in the ack_write_buf handling. An attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-12996) It was discovered that OpenVPN had a use-after-free in the tls_wrap_reneg handling. An attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13117) It was discovered that OpenVPN incorrectly validated authentication tokens when external authentication was enabled. A remote attacker could possibly use this issue to cause OpenVPN to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13122) It was discovered that OpenVPN had a memory leak when handling tls-crypt-v2 client keys. A remote attacker with a valid tls-crypt-v2 client key could possibly use this issue to cause OpenVPN to consume excessive resources, leading to a denial of service. (CVE-2026-13698)
AI Analysis
Technical Summary
This vulnerability (CVE-2026-11771) affects OpenVPN versions 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. It involves an off-by-one buffer write in the NTLM proxy authentication code path. An attacker controlling a malicious proxy server can send a specially crafted NTLM response that triggers this buffer write, leading to a potential crash of the OpenVPN client or server process. The issue is classified under CWE-121 (Stack-based Buffer Overflow). No known exploits in the wild have been reported. The CVSS 4.0 vector indicates network attack vector with high complexity and privileges not required, but user interaction is needed. The vulnerability impacts availability by causing crashes.
Potential Impact
Successful exploitation can cause the OpenVPN process to crash, resulting in denial of service. There is no indication from the provided data that this vulnerability allows code execution or data disclosure. The impact is limited to service disruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Users should monitor OpenVPN vendor advisories for updates and apply patches once available. Until then, avoid using untrusted proxy servers for NTLM authentication or disable NTLM proxy authentication if feasible.
openvpn vulnerabilities (CVE-2026-11771)
Description
It was discovered that OpenVPN had a 1-byte buffer overrun when handling NTLMv2 proxy responses. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-11771) It was discovered that OpenVPN incorrectly handled metadata when extracting tls-crypt-v2 client keys. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-12932) It was discovered that OpenVPN had a use-after-free in the ack_write_buf handling. An attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-12996) It was discovered that OpenVPN had a use-after-free in the tls_wrap_reneg handling. An attacker could use this issue to cause OpenVPN to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13117) It was discovered that OpenVPN incorrectly validated authentication tokens when external authentication was enabled. A remote attacker could possibly use this issue to cause OpenVPN to crash, resulting in a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13122) It was discovered that OpenVPN had a memory leak when handling tls-crypt-v2 client keys. A remote attacker with a valid tls-crypt-v2 client key could possibly use this issue to cause OpenVPN to consume excessive resources, leading to a denial of service. (CVE-2026-13698)
CVSS
Score 7.5high
Affected software
pkg:github/openvpn/openvpnRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-11771) affects OpenVPN versions 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. It involves an off-by-one buffer write in the NTLM proxy authentication code path. An attacker controlling a malicious proxy server can send a specially crafted NTLM response that triggers this buffer write, leading to a potential crash of the OpenVPN client or server process. The issue is classified under CWE-121 (Stack-based Buffer Overflow). No known exploits in the wild have been reported. The CVSS 4.0 vector indicates network attack vector with high complexity and privileges not required, but user interaction is needed. The vulnerability impacts availability by causing crashes.
Potential Impact
Successful exploitation can cause the OpenVPN process to crash, resulting in denial of service. There is no indication from the provided data that this vulnerability allows code execution or data disclosure. The impact is limited to service disruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the current data. Users should monitor OpenVPN vendor advisories for updates and apply patches once available. Until then, avoid using untrusted proxy servers for NTLM authentication or disable NTLM proxy authentication if feasible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v8ww-fhqp-9vff
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-11771"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a6bde199c2644c7f8dcad93
Added to database: 07/30/2026, 23:28:25 UTC
Last enriched: 07/31/2026, 00:14:21 UTC
Last updated: 09/13/2026, 22:01:31 UTC
Views: 47
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.