CVE-2026-12932 Denial of service in OpenVPN

What is CVE-2026-12932?

CVE-2026-12932 is a high-severity denial of service vulnerability in OpenVPN, published on 30 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

Weakness: CWE-401

Which versions are affected by CVE-2026-12932?

It affects 1 product.

Products include Openvpn Openvpn.

How do I fix CVE-2026-12932?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-12932 being exploited?

There is no known exploitation of CVE-2026-12932 in the wild and no public exploit code.

Other vulnerabilities in OpenVPN

• CVE-2025-12106 Memory corruption in OpenVPN Critical 9.1
• CVE-2024-5594 Information disclosure in OpenVPN Critical 9.1
• CVE-2018-7544 Cross-site request forgery in n/a Critical 9.1
• CVE-2006-1629 Code injection in n/a Critical 9.0
• CVE-2024-4877 Privilege escalation in OpenVPN High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-12932, DEBIAN-CVE-2026-12932, GHSA-93p4-5c7j-q5rx, OESA-2026-3929, UBUNTU-CVE-2026-12932.