CVE-2023-46849

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.6.0 through 2.6.6

Description The issue is related to the use of the --fragment option in certain configuration setups, which can cause a divide by zero behavior. This could lead to an application crash, resulting in a denial of service. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For OpenVPN versions 2.6.0 through 2.6.6, consider avoiding the use of the --fragment option in configuration setups until a patch is available. As a temporary workaround, restrict the use of the --fragment option to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.