Unrated

OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replay...

CVE-2025-2704 First seen on SecPulse Apr 3, 2025

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2025-2704 openvpn Fixed in: 2.6.16-r0
Debian DEBIAN-CVE-2025-2704 openvpn Fixed in: 2.6.3-1+deb12u3

Original description The description as published by the source.

OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory community.openvpn.net
advisory github.com
advisory nvd.nist.gov
advisory mail-archive.com
web openwall.com

Key facts

Severity: Unrated
Published: Apr 3, 2025
First seen on SecPulse: Apr 3, 2025
CWE: CWE-754

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 20:06