CVE-2025-54870
VTun-ng's failure to initialize encryption modules may cause reversion to plaintext
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
VTun-ng's failure to initialize encryption modules may cause reversion to plaintext
VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due to insufficient error handling. The bug was first introduced in VTun-ng version 3.0.12. This is fixed in version 3.0.18. To workaround this issue, avoid blowfish-256.
Reserved 2025-07-31 | Published 2025-08-05 | Updated 2025-08-05 | Assigner GitHub_MCWE-636: Not Failing Securely ('Failing Open')
github.com/...tun-ng/security/advisories/GHSA-m3jc-27c6-2wrf
github.com/...ommit/8c63982b6c487c52db1d56ab94c266f0bc857140
Support options
