CVE-2025-3110

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions 2.7.2 through 3.1.0

Description The software accepts bare line-feed sequences within HTTP header values. This behavior allows remote attackers to perform HTTP request smuggling when the system is deployed behind a reverse proxy. HTTP request smuggling is a technique that interferes with the way a website and its reverse proxy process sequences of HTTP requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.