The OpenVPN community project team is proud to release OpenVPN 2.6.23. This is a
bugfix release fixing several security issues.
Security fixes:
* ssl: do not trust the peer's request to resend the wrapped client key
* reliability layer: avoid unbounded reliable TLS timeout, and ignore acks for
packets that cannot be outstanding (CVE-2026-84732)
Both reliability layer bugs found by Mark Bregman (Fox-IT)
* improve on check_session_buf_not_used(), catch possible double-free in the
lame
duck case (CVE-2026-84471)
Bug reported by Andreas Gabriel Berbescu and Haruki Oyama (Waseda University)
* windows: fix CreateProcess() command line quoting for characters that are
special
to cmd.exe, where a combination of validation script plus rogue CA could lead
to
misbehavior (CVE-2026-84256)
Bug found by Clouditera Security
* windows: fix tapctl to always call netsh.exe with full path (as we do
elsewhere)
(CVE-2026-84226)
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
* windows: don't use NULL DACL with system objects, namely the --service exit
event
and the netsh.exe guard semaphore.
The old approach was prone to a local DoS where one user could interfere with
other users' openvpn processes by blocking the netsh semaphore or sending
events.
This only affects setups not using the iservice, or using the automatic
service to
start/stop openvpn (CVE-2026-82312)
Bug found by DEBRAJ BASAK
* dhcp (windows): fix off-by-one in write_dhcp_search_str() temp buffer guard -
suitable DHCP options could lead to a single-byte overflow of a temp buffer
(CVE-2026-81738)
Bug found by Andre Kropp (Nexory) and ChinhNguyen
* openvpnserv (windows): detect and refuse sibling dirs in CheckConfigPath()
(CVE-2026-81830)
Bug found by Harshit Varu
More details can be found in the Changes document:
<https://github.com/OpenVPN/openvpn/blob/v2.6.23/Changes.rst
<https://github.com/OpenVPN/openvpn/blob/v2.7./Changes.rst>>
Source code can be downloaded from our download page:
<https://openvpn.net/community/>
Kind regards,
Yuriy Darnobyt
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
