← Back

CVE-2026-13122

nvd nist
Published: Jul 6, 2026Modified: Jul 9, 2026

JSON object

Loading...
5.9
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: security@openvpn.net (Secondary)

Description

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled

Affected (2)

Products: Openvpn: Openvpn
Openvpn
1 product
Openvpn
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Openvpn
Openvpn
From 2.6.0 to 2.6.21
Openvpn
From 2.7 to 2.7.5

Related CWEs

CWE-617
Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (1)

Source: security@openvpn.net
Vendor Advisory

Timeline

No history available yet.