CVE-2026-13122 Denial of service in OpenVPN

What is CVE-2026-13122?

CVE-2026-13122 is a medium-severity denial of service vulnerability in OpenVPN, published on 6 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled

Weakness: CWE-617

Which versions are affected by CVE-2026-13122?

It affects 1 product.

Products include Openvpn Openvpn.

How do I fix CVE-2026-13122?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-13122 being exploited?

There is no known exploitation of CVE-2026-13122 in the wild and no public exploit code.

Other vulnerabilities in OpenVPN

• CVE-2025-12106 Memory corruption in OpenVPN Critical 9.1
• CVE-2024-5594 Information disclosure in OpenVPN Critical 9.1
• CVE-2018-7544 Cross-site request forgery in n/a Critical 9.1
• CVE-2006-1629 Code injection in n/a Critical 9.0
• CVE-2024-4877 Privilege escalation in OpenVPN High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-13122, DEBIAN-CVE-2026-13122, GHSA-m5x7-29rp-3xmr, UBUNTU-CVE-2026-13122.