CVE-2013-2061

OpenVPN 2.3.0 and earlier is affected in UDP mode due to two issues in crypto.c: (1) openvpn_decrypt uses an HMAC comparison that does not run in constant time, enabling timing-based information disclosure, and (2) a padding oracle risk in the CBC mode cipher. Exploitation could allow an unauthen...

CVE-2023-46850

CVE-2023-46850 concerns OpenVPN 2.6.0–2.6.6, where a use-after-free when sending network buffers to a remote peer can cause undefined behavior, memory leakage, or remote code execution. Multiple connected advisories confirm this issue and document downstream fixes across distros: Debian/DSA-5555-...

CVE-2023-46849

CVE-2023-46849 affects OpenVPN 2.6.0–2.6.6, where a divide-by-zero can crash the app and cause denial of service. CVE-2023-46850 is a use-after-free in OpenVPN 2.6.0–2.6.6, potentially leaking memory or enabling remote execution when sending network buffers to a remote peer. Public advisories con...

CVE-2020-8953

CVE-2020-8953 affects OpenVPN Access Server 2.8.x prior to 2.8.1, where an LDAP authentication bypass is possible unless the user is enrolled in two-factor authentication. The description explicitly identifies the affected product/version and the root cause as an LDAP authentication bypass, enabl...

CVE-2022-33737

Summary: CVE-2022-33737 affects OpenVPN Access Server installers. The issue arises because the installer creates a log file that is readable by everyone, and in OpenVPN Access Server versions 2.10.0 through 2.10.x (up to but not including 2.11.0) this log may contain a randomly generated administ...

CVE-2017-5868

OpenVPN Access Server 2.1.4 is affected by a CRLF injection in the web interface that can be triggered via %0A in PATH_INFO to session_start , enabling header injection and potentially session fixation attacks (and possibly HTTP response splitting). The vulnerability is documented across multiple...

CVE-2006-1629

OpenVPN CVE-2006-1629 affects OpenVPN client versions 2.0–2.0.5. A remote server can exploit this by pushing an LD_PRELOAD environment variable via setenv, enabling arbitrary code execution on the client. Root cause: environment-variable handling in client startup allowing injection. Impact: remo...

CVE-2005-3393

OpenVPN 2.0.x is affected by CVE-2005-3393 due to a format-string vulnerability in the foreign_option function (options.c) used when pushing dhcp-option. This could allow a remote attacker to execute arbitrary code on non-Windows OpenVPN clients during TLS negotiation if the server/client configu...

CVE-2014-8104

Summary: CVE-2014-8104 affects OpenVPN 2.x (various branches) and allows a remote authenticated attacker to cause a denial of service (server crash) by sending a small control channel packet. The root cause is improper handling of too-small control channel packets. Impact: denial of service with ...

CVE-2005-3409

OpenVPN 2.x is affected by CVE-2005-3409 (pre-2.0.4). The issue is a denial-of-service caused by forcing accept() to return an error, which leads to a NULL pointer dereference in the exception handler, potentially crashing the service. The vulnerability affects OpenVPN servers operating in TCP mo...

CVE-2022-33738

The CVE-2022-33738 entry concerns OpenVPN Access Server prior to version 2.11, where a weak random generator is used to create user session tokens for the web portal. This weak RNG could potentially compromise session tokens, impacting authentication for the portal. The connected sources corrobor...

CVE-2021-4234

OpenVPN Access Server 2.10 and earlier are affected by a vulnerability where the server resends multiple packets in response to a client-sent reset, which the client does not respond to, enabling a limited amplification attack. The issue is documented in CVE-2021-4234 with a HIGH impact on availa...

CVE-2020-36382

OpenVPN Access Server versions 2.7.3 through 2.8.7 are affected by CVE-2020-36382. The issue is a failure during the user authentication phase where incorrect authentication token data can trigger an assert, leading to a denial of service. This vulnerability is documented by SUSE security advisor...

CVE-2006-2229

OpenVPN 2.0.7 and earlier, when configured to use --management with an IP not equal to 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service. The provided connected documents...

CVE-2020-11462

CVE-2020-11462 affects OpenVPN Access Server prior to 2.7.0 and 2.8.x prior to 2.8.3. When the full-featured RPC2 interface is enabled, sending an XML Entity Expansion (XEE) payload to the XMLRPC-based RPC2 interface can trigger a temporary DoS on the management interface. The DoS duration depend...

CVE-2020-15077

OpenVPN Access Server CVE-2020-15077 affects OpenVPN Access Server 2.8.7 and earlier. The vulnerability allows remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication, potentially enabling information leaks. The connected docume...

CVE-2014-9104

CVE-2014-9104 covers CSRF vulnerabilities in the XML-RPC API of the OpenVPN Access Server Desktop Client (versions up to 1.5.6). The issues allow an attacker to hijack administrator authentication and perform actions via crafted API requests, including disconnecting VPN sessions, connecting to ar...

CVE-2021-3824

OpenVPN Access Server 2.9.0–2.9.4 is affected by a cross‑site scripting (XSS) vulnerability in the web login page URL, allowing remote attackers to inject arbitrary web script/HTML. Root cause: improper handling of characters in the login page URL. Impact: potential execution of malicious script ...

CVE-2020-15074

CVE-2020-15074 affects OpenVPN Access Server versions older than 2.8.4 and 2.9.5, where reconnects generate new user authentication tokens instead of reusing existing tokens, bypassing the initial token expiry timestamp. The provided documents do not specify affected product versions beyond those...

CVE-2025-3110

CVE-2025-3110 affects OpenVPN Access Server 2.7.2 through 3.1.0, where the server accepts bare line-feed sequences inside HTTP header values, enabling HTTP request smuggling when deployed behind a reverse proxy. Red Hat’s advisory notes this flaw stems from unstandardized LF handling in HTTP head...

CVE-2013-2692

OpenVPN Access Server before 1.8.5 is affected by a CSRF vulnerability in the Admin web interface that can allow an attacker to hijack the authentication of administrators and perform actions to create new administrative users. The issue is described as a cross-site request forgery affecting the ...