CVE-2025-2704

Published: Apr 2, 2025Modified: Oct 23, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase

Affected (1)

Products: Openvpn: Openvpn

Openvpn

1 product

Openvpn

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openvpn Openvpn	From 2.6.1 to 2.6.13

Related CWEs

CWE-754

Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

References (3)

https://community.openvpn.net/openvpn/wiki/CVE-2025-2704

Source: security@openvpn.net

Broken Link

https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00142.html

Source: security@openvpn.net

http://www.openwall.com/lists/oss-security/2025/04/02/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.