Skip to content
OpenAdvisories
Medium ALAS2023-2026-2038 3 CVEs

Moderate: openvpn security update (Amazon Linux 2023)

Published Aug 3, 2026 · Updated Aug 4, 2026

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-13698: An internal server error condition that can be triggered by a malicous authenticated client, a very unlucky corruption of packets in transit or by an attacker that is able to inject a specially created packet at the right time and is able to observe the traffic to construct the packet. CVE-2026-13117: When dynamic tls-crypt is active, it is possible for tls_multi_process to set to_link to session->tls_wrap_reneg.work and later free that session, leaving to_link.data pointing to freed memory. CVE-2026-12932: OpenVPN memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes

Fixed packages 4

ReleasePackageFixed in
Amazon Linux · 2023 openvpn 0:2.6.12-1.amzn2023.0.7
Amazon Linux · 2023 openvpn-debuginfo 0:2.6.12-1.amzn2023.0.7
Amazon Linux · 2023 openvpn-debugsource 0:2.6.12-1.amzn2023.0.7
Amazon Linux · 2023 openvpn-devel 0:2.6.12-1.amzn2023.0.7

Vulnerabilities 3

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-12932.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-13117.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-13698.html