CVE-2026-13117 Use after free in OpenVPN

What is CVE-2026-13117?

CVE-2026-13117 is a medium-severity use after free vulnerability in OpenVPN, published on 30 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage

Weakness: CWE-416

Which versions are affected by CVE-2026-13117?

It affects 1 product.

Products include Openvpn Openvpn.

How do I fix CVE-2026-13117?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-13117 being exploited?

There is no known exploitation of CVE-2026-13117 in the wild and no public exploit code.

Other vulnerabilities in OpenVPN

• CVE-2025-12106 Memory corruption in OpenVPN Critical 9.1
• CVE-2024-5594 Information disclosure in OpenVPN Critical 9.1
• CVE-2018-7544 Cross-site request forgery in n/a Critical 9.1
• CVE-2006-1629 Code injection in n/a Critical 9.0
• CVE-2024-4877 Privilege escalation in OpenVPN High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-13117, DEBIAN-CVE-2026-13117, GHSA-6qjm-gj5v-hp7g, UBUNTU-CVE-2026-13117.