CVE-2026-84471
The fix for CVE-2026-12996 was incomplete.
Published Oct 14, 2026 · updated Oct 14, 2026
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
Oct 14, 2026 · OSV.dev
Fix available
openvpn fixed in 2.7.7-1
Oct 14, 2026 · OSV.dev
Fix available
openvpn fixed in 2.7.7-1
Oct 14, 2026 · OSV.dev
Updated
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
Affected
- Debian:12 openvpn2.6.11-1, 2.6.12-1, 2.6.13-1
- Debian:13 openvpn2.6.14-1, 2.6.14-1+deb13u1, 2.6.14-1+deb13u2
- Debian:14 openvpn0 → 2.7.7-1
Sources
- CVE.orgCVE-2026-84471
Official CVE identifier
cve.org - NIST NVDCVE-2026-84471
The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
nvd.nist.gov - OSV.devDEBIAN-CVE-2026-84471osv.dev