CVE-2026-12932CWE-401

CVE-2026-12932

High · published July 30, 2026

CVSS v3.1

8.1

EPSS

Percentile

34.9

In the wild

Unconfirmed

What it is

A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packets

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00417 · 34.9th percentile
Weakness: CWE-401 · Missing Release of Memory after Effective Lifetime
Published: 2026-07-30T21:16Z

Affected products (2)

Product	Versions	Fixed in
openvpn/openvpn	≥ 2.5.0, < 2.6.21	2.6.21
openvpn/openvpn	≥ 2.7, < 2.7.5	2.7.5

References (3)

https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026 · [email protected]https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026 · [email protected]https://community.openvpn.net/Security%20Announcements/CVE-2026-12932 · [email protected]

EPSS history

Timeline

30 JUL 16:42Z
A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial…
cvelistv5