CVE-2026-13117

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.6.0 through 2.6.20 OpenVPN versions 2.7 alpha1 through 2.7.4

Description An incomplete guard in the tls-crypt-v2 mechanism allows remote authenticated peers to trigger a use-after-free condition during TLS session promotion. This occurs within the check session buf not used() function and the tls wrap reneg process. A use-after-free is a scenario where a program continues to use a pointer after it has been freed, which can lead to memory leakage, denial of service, or arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.