CVE-2026-40215 Use after free in OpenVPN

What is CVE-2026-40215?

CVE-2026-40215 is a medium-severity use after free vulnerability in OpenVPN, published on 8 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Weakness: CWE-416, CWE-125

Which versions are affected by CVE-2026-40215?

It affects 1 product.

Products include Openvpn Openvpn.

How do I fix CVE-2026-40215?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-40215 being exploited?

There is no known exploitation of CVE-2026-40215 in the wild and no public exploit code.

Other vulnerabilities in OpenVPN

• CVE-2025-12106 Memory corruption in OpenVPN Critical 9.1
• CVE-2024-5594 Information disclosure in OpenVPN Critical 9.1
• CVE-2018-7544 Cross-site request forgery in n/a Critical 9.1
• CVE-2006-1629 Code injection in n/a Critical 9.0
• CVE-2024-4877 Privilege escalation in OpenVPN High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-40215, DEBIAN-CVE-2026-40215, GHSA-3mmv-h5fc-pvwj, OESA-2026-2625, UBUNTU-CVE-2026-40215.