Important: openvpn security update (Amazon Linux 2023)

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-13122: openvpn Server crash on reception of suitably malformed auth-token, if --auth-gen-token external-auth is active CVE-2026-12996: If the active TLS session has a pending dedicated ACK packet, tls_multi_process sets to_link to ks->ack_write_buf. If in the same execution of tls_multi_process, the initializing session reaches the authenticated stage, the active session will be freed which leaves to_link.data pointing to freed memory. CVE-2026-11771: An attacker controlling an HTTP proxy (or performing MITM on the plaintext pre-TLS proxy connection) can trigger a single 0-byte overrun to a buffer on the stack by sending a crafted NTLM Type 2 challenge response.