OpenVPN Releases Critical Patches Addressing DoS and Security Bypass Vulnerabilities

info@teralevel.com (TeraLevel) — Tue, 09 Dec 2025 00:00:00 +0000

Critical Alert in OpenVPN: DoS and Security Bypass

OpenVPN has issued a critical alert requiring immediate attention from all administrators. The new stable (2.6.17) and development (2.7_rc3) versions fix three significant vulnerabilities that jeopardize the availability and security of VPN connections.

Key Vulnerabilities Include:

CVE ID	Primary Impact	Affected Branches
CVE-2025-13751	Local Denial-of-Service (DoS). Causes complete service crash in Windows environments.	2.6 and 2.7 (rc2)
CVE-2025-13086	Security Bypass in HMAC verification. Allows attackers to open TLS sessions without source IP validation.	2.6 (up to 2.6.15)
CVE-2025-12106	Memory Safety issue (Buffer Over-read) in IPv6 handling.	2.7 branch only (rc1)

The most serious flaw for perimeter security is CVE-2025-13086, which effectively nullifies the HMAC cookie validation during the three-way handshake. This allows malicious actors to bypass the initial check and consume server resources without a legitimate connection. Administrators must immediately migrate to the patched versions to restore service integrity and stability, especially in critical infrastructures that rely on OpenVPN for secure remote access.

Monitoring on TeraLevel

OpenVPN Releases Critical Patches Addressing DoS and Security Bypass Vulnerabilities

Critical Alert in OpenVPN: DoS and Security Bypass