Description
Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenVPN | OpenVPN | 2.5.0 – ≤ 2.6.16, 2.7_alpha1 – ≤ 2.7_rc2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | openvpn +5 | 2.6.17-r0 | — |
Advisories 1
- WID-SEC-2025-2713 OpenVPN: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Dec 3, 2025