https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-13379.htmlhttps://patchthecve.com/cve/CVE-2026-13379.htmlWed, 05 Aug 2026 19:37:28 +0000CRITICAL 9.1: The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection processhttps://patchthecve.com/cve/CVE-2026-13117.htmlhttps://patchthecve.com/cve/CVE-2026-13117.htmlWed, 05 Aug 2026 19:37:47 +0000HIGH 8.1: An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakagehttps://patchthecve.com/cve/CVE-2026-12996.htmlhttps://patchthecve.com/cve/CVE-2026-12996.htmlWed, 05 Aug 2026 19:38:07 +0000HIGH 8.1: A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiryhttps://patchthecve.com/cve/CVE-2026-12932.htmlhttps://patchthecve.com/cve/CVE-2026-12932.htmlWed, 05 Aug 2026 19:38:24 +0000HIGH 8.1: A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packetshttps://patchthecve.com/cve/CVE-2026-11771.htmlhttps://patchthecve.com/cve/CVE-2026-11771.htmlWed, 05 Aug 2026 19:38:34 +0000HIGH 7.5: OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy serverhttps://patchthecve.com/cve/CVE-2025-3110.htmlhttps://patchthecve.com/cve/CVE-2025-3110.htmlTue, 29 Sep 2026 19:10:00 +0000HIGH 7.5: OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxyhttps://patchthecve.com/cve/CVE-2026-13122.htmlhttps://patchthecve.com/cve/CVE-2026-13122.htmlThu, 09 Jul 2026 13:06:19 +0000MEDIUM 5.3: OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabledhttps://patchthecve.com/cve/CVE-2026-13698.htmlhttps://patchthecve.com/cve/CVE-2026-13698.htmlThu, 09 Jul 2026 13:05:30 +0000HIGH 7.5: A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service