CVE-2025-2704

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.6.1 through 2.6.13

Description The issue allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase when OpenVPN is used in server mode with TLS-crypt-v2. It is estimated that over 3.2 million services are potentially affected. The vulnerability can be exploited to crash servers.

Recommendations For OpenVPN versions 2.6.1 through 2.6.13, update to version 2.6.14 to resolve the issue. As a temporary workaround, consider disabling the use of TLS-crypt-v2 until a patch is applied. Restrict access to the vulnerable server mode to minimize the risk of exploitation. Avoid using the --tls-crypt-v2 option in the affected OpenVPN versions until the issue is resolved.