CVE-2025-2704

Description

OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase

Reserved 2025-03-24 | Published 2025-04-02 | Updated 2025-04-07 | Assigner OpenVPN

Problem types

CWE-754 Improper Check for Unusual or Exceptional Conditions

Product status

Default status
unaffected

2.6.1
affected

References

community.openvpn.net/openvpn/wiki/CVE-2025-2704

cve.org (CVE-2025-2704)

nvd.nist.gov (CVE-2025-2704)

Download JSON