CVE-2025-13086 Denial of service in OpenVPN

Medium 4.6 Published 3 Dec 2025 Updated 12 Dec 2025

An attacker can cause a denial of service for the originating client by opening a session from a different IP address due to improper source IP validation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-13086?

CVE-2025-13086 is a medium-severity denial of service vulnerability in OpenVPN, published on 3 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

Weakness: CWE-940

Which versions are affected by CVE-2025-13086?

It affects 1 product.

Linux distribution packages (11)

`openvpn` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`2.6.10-150600.3.20.1`
`openvpn-dco` SUSE:Linux Enterprise Module for Basesystem 15 SP7	All versions	`2.6.10-150600.3.20.1`
`openvpn` SUSE:Linux Enterprise Server 15 SP6-LTSS	All versions	`2.6.10-150600.3.20.1`
`openvpn-dco` SUSE:Linux Enterprise Server 15 SP6-LTSS	All versions	`2.6.10-150600.3.20.1`
`openvpn` SUSE:Linux Enterprise Server 16.0	All versions	`2.6.10-160000.3.1`
`openvpn` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	All versions	`2.6.10-150600.3.20.1`
`openvpn-dco` SUSE:Linux Enterprise Server for SAP Applications 15 SP6	All versions	`2.6.10-150600.3.20.1`
`openvpn` SUSE:Linux Enterprise Server for SAP applications 16.0	All versions	`2.6.10-160000.3.1`
`openvpn` openSUSE:Leap 15.6	All versions	`2.6.10-150600.3.20.1`
`openvpn-dco` openSUSE:Leap 15.6	All versions	`2.6.10-150600.3.20.1`
`openvpn` openSUSE:Leap 16.0	All versions	`2.6.10-160000.3.1`

Products include Openvpn Openvpn.

How do I fix CVE-2025-13086?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-13086 being exploited?

There is no known exploitation of CVE-2025-13086 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2025-13086, CLEANSTART-2026-MZ17549, DEBIAN-CVE-2025-13086, DSA-6069-1, GHSA-xv5w-q5wq-r3c3, OESA-2025-2742 and 7 more.