DSA-6376-1 openvpn - security update
Multiple security vulnerabilities were discovered in OpenVPN, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6376-1
CSIRTS triage
- What
- Multiple security vulnerabilities could result in denial of service.
- Who is affected
- Deployments of OpenVPN.
- Urgency
- Remediation is important as these vulnerabilities could disrupt service availability.
- Action
- Apply the latest security update for OpenVPN.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch OpenVPN
Get an email when a new OpenVPN advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00287.html
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-117710.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-129320.42% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-129960.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-131170.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-131220.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-136980.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-11771 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-12932 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-12996 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-13117 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-13122 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-13698 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [hoch] OpenVPN: Mehrere Schwachstellencert-bund
- highCVE-2026-13117: An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote…nvd
- highCVE-2026-12996: A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote au…nvd
- highCVE-2026-12932: A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.…nvd
- highCVE-2026-11771: OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-…nvd
- unknownUSN-8540-1: OpenVPN vulnerabilitiesubuntu
- mediumCVE-2026-13122: OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to c…nvd
- highCVE-2026-13698: A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 thr…nvd
More from Debian Security Advisories
- unknownDSA-6491-1 slurm-wlm - security update2026-09-09
- unknownDSA-6489-1 gst-plugins-base1.0 - security update2026-09-08
- unknownDSA-6490-1 fort-validator - security update2026-09-08
- unknownDSA-6488-1 jbig2dec - security update2026-09-07
- unknownDSA-6487-1 strongswan - security update2026-09-07