CVE-2026-13698CWE-401CWE-770

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2…

Medium · published July 6, 2026

CVSS v4.0
6.0
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00549 · 45.2th percentile
Weaknesses
CWE-401 · Missing Release of Memory after Effective Lifetime; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-06T14:13Z
EPSS history
Timeline
  • 06 JUL 14:13Z
    A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2…
    cvelistv5