汇总 OpenVPN 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
历史漏洞主要涉及 跨站脚本与CSRF 等问题，部分漏洞可能导致 会话劫持，并影响 生产负载与软件部署 相关场景。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2025-3110 | OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy | [email protected] | 6.9 | 0.31% | 2026-07-08 | 2026-07-10 |
| CVE-2026-13122 | OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled | [email protected] | 5.9 | 0.47% | 2026-07-06 | 2026-07-09 |
| CVE-2026-13698 | A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service | [email protected] | 6.0 | 0.52% | 2026-07-06 | 2026-07-09 |
| CVE-2026-9560 | Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel | [email protected] | 9.4 | 0.57% | 2026-05-26 | 2026-06-17 |
| CVE-2025-15497 | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of service | [email protected] | 3.8 | 0.32% | 2026-01-30 | 2026-06-17 |
| CVE-2025-13086 | Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client | [email protected] | 4.6 | 0.61% | 2025-12-03 | 2026-06-17 |
| CVE-2025-13751 | Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service. | [email protected] | 1.3 | 0.15% | 2025-12-03 | 2026-06-17 |
| CVE-2025-12106 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses | [email protected] | 9.1 | 0.53% | 2025-12-01 | 2026-06-17 |
| CVE-2025-50055 | Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter | [email protected] | 6.4 | 0.18% | 2025-10-27 | 2026-06-17 |
| CVE-2025-50054 | Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to the kernel driver resulting in a system crash | [email protected] | 5.5 | 0.22% | 2025-06-20 | 2026-06-17 |
| CVE-2025-3908 | The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory. | [email protected] | 6.2 | 0.18% | 2025-05-19 | 2026-06-17 |
| CVE-2024-4877 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges | [email protected] | 8.8 | 0.41% | 2025-04-03 | 2026-06-17 |
| CVE-2025-2704 | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase | [email protected] | 7.5 | 0.78% | 2025-04-02 | 2026-06-17 |
| CVE-2024-13454 | Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenSSL 3 | [email protected] | 5.3 | 0.08% | 2025-01-20 | 2026-06-17 |
| CVE-2024-5198 | OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt. | [email protected] | 3.3 | 0.10% | 2025-01-15 | 2026-06-17 |
| CVE-2024-8474 | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic | [email protected] | 7.5 | 0.53% | 2025-01-06 | 2026-06-17 |
| CVE-2024-5594 | OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs. | [email protected] | 9.1 | 0.81% | 2025-01-06 | 2026-06-17 |
| CVE-2024-28882 | OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session | [email protected] | 4.3 | 0.67% | 2024-07-08 | 2026-06-17 |
| CVE-2024-1305 | tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting in a bug check and potentially arbitrary code execution in kernel space | [email protected] | 9.8 | 15.38% | 2024-07-08 | 2026-06-17 |
| CVE-2024-27903 | OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service. | [email protected] | 9.8 | 8.92% | 2024-07-08 | 2026-06-17 |