CVE-2026-40215

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.6.0 through 2.6.19 OpenVPN versions 2.7 alpha1 through 2.7.1

Description A race condition occurs during the TLS handshake, specifically during TLS session promotion. This issue can be triggered by remote attackers, potentially leading to a server crash or the leaking of heap memory, which may include packet data from a previous handshake. A race condition is a situation where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events.

Recommendations Update OpenVPN versions 2.6.0 through 2.6.19 to a version where this issue is resolved. Update OpenVPN versions 2.7 alpha1 through 2.7.1 to a version where this issue is resolved.