Read the docs
TI-2026-74035 Aliases CVE-2026-84471GHSA-qpwh-qgw4-8g2c

Use-after-free in OpenVPN TLS session handling

Priority LOW 32CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

OpenVPN versions 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 contain a use-after-free flaw (CWE-416) in the fix for an earlier issue, CVE-2026-12996. A remote authenticated peer can send crafted packets during TLS session promotion or expiry, which can cause a denial of service or leak memory.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00408 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenVPNOpenVPN2.6.0 – 2.6.22; 2.7_alpha1 – 2.7.7—No fix listedCNA
  • OpenVPN VendorOpenVPN Affected 2.6.0 – 2.6.22; 2.7_alpha1 – 2.7.7 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:*——OpenVPN
  • cpe:2.3:a:openvpn:openvpn:*:*:*:*:*:*:*:* Versions — — ·OpenVPN

Remediation

The sources list no fixed version for OpenVPN.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-84471
  2. 2026-10-14 Alias added: GHSA-qpwh-qgw4-8g2c
  3. 2026-10-16 Priority changed: MEDIUM → LOW
  4. 2026-10-16 Affected versions changed · Red Hat
  5. 2026-10-16 CVSS score added · Red Hat
  6. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2024-01215 Integer overflow in OpenVPN tap-windows6 CVSS 3.1CRITICAL 9.8
  • TI-2014-04453 Unquoted Windows search path vulnerability in the ptservice service prior to… CVSS 3.1MEDIUM 5.3
  • TI-2022-00467 Authentication bypass in OpenVPN CVSS 3.1CRITICAL 9.8
  • TI-2024-18509 Unrestricted file upload in OpenVPN 2 CVSS 3.1CRITICAL 9.8
  • TI-2024-16468 The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to… CVSS 3.1HIGH 7.5
  • TI-2023-25309 Use after free in OpenVPN 2 CVSS 3.1CRITICAL 9.8
See all 99 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences