CVE-2026-13117CWE-416

CVE-2026-13117

High · published July 30, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.8th percentile
Weakness
CWE-416 · Use After Free
Published
2026-07-30T21:16Z
Affected products (2)
ProductVersionsFixed in
openvpn/openvpn≥ 2.6.0, < 2.6.212.6.21
openvpn/openvpn≥ 2.7, < 2.7.52.7.5
References (3)
https://community.openvpn.net/ReleaseHistory#openvpn-2621-released-1-july-2026 · [email protected]https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026 · [email protected]https://community.openvpn.net/Security%20Announcements/CVE-2026-13117 · [email protected]
EPSS history
Timeline
  • 30 JUL 16:32Z
    An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS…
    cvelistv5