DescriptionOpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1074488

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
openvpn (PTS)bullseye2.5.1-3fixed
bookworm, bookworm (security)2.6.3-1+deb12u2vulnerable
sid, trixie2.6.12-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
openvpnsourcebullseye(not affected)


[bookworm] - openvpn <no-dsa> (Minor issue)
[bullseye] - openvpn <not-affected> (Vulnerable code not present)
Introduced by: (v2.6_beta1)
Fixed by: (v2.6.11)

Search for package or bug name: Reporting problems