CVE-2024-5594 Information disclosure in OpenVPN

Critical 9.1 Published 6 Jan 2025 Updated 3 Nov 2025

A malicious OpenVPN server can inject arbitrary data into client logs, potentially exposing sensitive information to attackers.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-5594?

CVE-2024-5594 is a critical vulnerability in OpenVPN, published on 6 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

Weakness: CWE-1287

Which versions are affected by CVE-2024-5594?

It affects 1 product.

Linux distribution packages (17)

`openvpn` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	All versions	`2.5.6-150400.3.9.1`
`openvpn` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	All versions	`2.5.6-150400.3.9.1`
`openvpn` SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS	All versions	`2.5.6-150400.3.9.1`
`openvpn` SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS	All versions	`2.5.6-150400.3.9.1`
`openvpn` SUSE:Linux Enterprise Module for Basesystem 15 SP6	All versions	`2.6.8-150600.3.14.1`
`openvpn-dco` SUSE:Linux Enterprise Module for Basesystem 15 SP6	All versions	`2.6.8-150600.3.14.1`
`openvpn` SUSE:Linux Enterprise Server 12 SP5-LTSS	All versions	`2.3.8-16.35.1`
`openvpn` SUSE:Linux Enterprise Server 15 SP4-LTSS	All versions	`2.5.6-150400.3.9.1`
`openvpn` SUSE:Linux Enterprise Server 15 SP5-LTSS	All versions	`2.5.6-150400.3.9.1`
`openvpn` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5	All versions	`2.3.8-16.35.1`
`openvpn` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	All versions	`2.5.6-150400.3.9.1`
`openvpn` SUSE:Linux Enterprise Server for SAP Applications 15 SP5	All versions	`2.5.6-150400.3.9.1`
`openvpn` SUSE:Manager Proxy 4.3	All versions	`2.5.6-150400.3.9.1`
`openvpn` SUSE:Manager Server 4.3	All versions	`2.5.6-150400.3.9.1`
`openvpn` openSUSE:Leap 15.6	All versions	`2.6.8-150600.3.14.1`
`openvpn-dco` openSUSE:Leap 15.6	All versions	`2.6.8-150600.3.14.1`
`openvpn` openSUSE:Tumbleweed	All versions	`2.6.10-5.1`

Products include Openvpn Openvpn.

How do I fix CVE-2024-5594?

Upgrade to a fixed version.

Is CVE-2024-5594 being exploited?

There is no known exploitation of CVE-2024-5594 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2024-5594, CLSA-2025-1744710425, CLSA-2025-1744727573, DEBIAN-CVE-2024-5594, GHSA-f2h8-4w6p-535w, MGASA-2024-0255 and 7 more.