CVE-2026-13122CWE-617

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token…

Medium · published July 6, 2026

CVSS v4.0
5.9
EPSS
0%
Percentile
38.7
In the wild
Unconfirmed
What it is

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled

The record
Technical detail
CVSS v4.0
5.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00458 · 38.7th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2026-07-06T14:32Z
EPSS history
Timeline
  • 06 JUL 14:32Z
    OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token…
    cvelistv5