Home

Description

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

PUBLISHED Reserved 2025-11-12 | Published 2025-12-03 | Updated 2025-12-03 | Assigner OpenVPN




MEDIUM: 4.6CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U

Problem types

CWE-940: Improper Verification of Source of a Communication Channel

Product status

Default status
unaffected

2.6.0 (semver)
affected

References

community.openvpn.net/Security Announcements/CVE-2025-13086 vendor-advisory

www.mail-archive.com/...@lists.sourceforge.net/msg00152.html release-notes

www.mail-archive.com/...@lists.sourceforge.net/msg00151.html release-notes

cve.org (CVE-2025-13086)

nvd.nist.gov (CVE-2025-13086)