Memory leak in OpenVPN Server - CVE-2026-13698

Vulnerability identifier: #VU139875

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-13698

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a memory leak in tls-crypt-v2 packet handling when processing suitable tls-crypt-v2 packets. A remote attacker can send specially crafted packets to cause a denial of service.

The issue can lead to an out-of-memory condition before the server crashes.

OpenVPN Server
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
openvpn-help
openvpn-devel
openvpn-debugsource
openvpn-debuginfo
openvpn
openvpn (Ubuntu package)
openvpn-dco
openvpn-dco-devel
openvpn-dco-debugsource
openvpn-auth-pam-plugin-debuginfo
openvpn-auth-pam-plugin
openvpn-down-root-plugin
openvpn-down-root-plugin-debuginfo
openvpn-dco-debuginfo
openvpn (Debian package)

Install security update from vendor's website.

OpenVPN Server - addressed in versions 2.6.21, 2.7.5
openvpn-help - addressed in versions 2.5.5-10, 2.6.9-8
openvpn-devel - addressed in versions 2.5.5-10, 2.6.9-8
openvpn-debugsource - addressed in versions 2.5.5-10, 2.6.9-8
openvpn-debuginfo - addressed in versions 2.5.5-10, 2.6.9-8
openvpn - addressed in versions 2.5.5-10, 2.6.9-8
openvpn (Ubuntu package) - addressed in versions 2.5.11-0ubuntu0.22.04.4, 2.6.19-0ubuntu0.24.04.3, 2.7.0-1ubuntu1.2
openvpn-debugsource - update to 2.6.10-150600.3.23.1
openvpn-dco - update to 2.6.10-150600.3.23.1
openvpn-dco-devel - update to 2.6.10-150600.3.23.1
openvpn-dco-debugsource - update to 2.6.10-150600.3.23.1
openvpn-debuginfo - update to 2.6.10-150600.3.23.1
openvpn-auth-pam-plugin-debuginfo - update to 2.6.10-150600.3.23.1
openvpn-devel - update to 2.6.10-150600.3.23.1
openvpn-auth-pam-plugin - update to 2.6.10-150600.3.23.1
openvpn - update to 2.6.10-150600.3.23.1
openvpn-down-root-plugin - update to 2.6.10-150600.3.23.1
openvpn-down-root-plugin-debuginfo - update to 2.6.10-150600.3.23.1
openvpn-dco-debuginfo - update to 2.6.10-150600.3.23.1
openvpn (Debian package) - update to 2.6.14-1+deb13u3

• https://github.com/OpenVPN/openvpn/releases/tag/v2.6.21
• https://github.com/OpenVPN/openvpn/commit/4dee614e4e799d6d4a20bffabd902291c86406f2

• Multiple vulnerabilities in OpenVPN Server
• Debian update for openvpn
• openEuler 24.03 LTS SP1 update for openvpn
• openEuler 24.03 LTS SP3 update for openvpn
• openEuler 24.03 LTS SP4 update for openvpn
• Ubuntu update for openvpn
• SUSE update for openvpn
• openEuler 22.03 LTS SP4 update for openvpn