Vulnerability · Published Dec 3, 2025 · Assigned by OpenVPN
CVE-2025-13086
Medium 4.6
In plain English
A medium-severity security flaw in OpenVPN from OpenVPN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)4.6Medium
Exploit odds (30 days)0.7%top 48.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | openvpn | 2.6.16-r0 | ALPINE-CVE-2025-13086 |
| Alpine:v3.21 | openvpn | 2.6.16-r0 | ALPINE-CVE-2025-13086 |
| Alpine:v3.22 | openvpn | 2.6.16-r0 | ALPINE-CVE-2025-13086 |
| Alpine:v3.23 | openvpn | 2.6.16-r0 | ALPINE-CVE-2025-13086 |
| Alpine:v3.24 | openvpn | 2.6.16-r0 | ALPINE-CVE-2025-13086 |
| Debian:12 | openvpn | 2.6.3-1+deb12u4 | DSA-6069-1 |
| Debian:12 | openvpn | 2.6.3-1+deb12u4 | DEBIAN-CVE-2025-13086 |
| Debian:13 | openvpn | 2.6.14-1+deb13u1 | DEBIAN-CVE-2025-13086 |
| Debian:13 | openvpn | 2.6.14-1+deb13u1 | DSA-6069-1 |
| Debian:14 | openvpn | 2.7.0~rc2-2 | DEBIAN-CVE-2025-13086 |
| Ubuntu:24.04:LTS | openvpn | 2.6.14-0ubuntu0.24.04.3 | USN-7898-1 |
| Ubuntu:24.04:LTS | openvpn | 2.6.14-0ubuntu0.24.04.3 | UBUNTU-CVE-2025-13086 |
| Ubuntu:25.10 | openvpn | 2.6.14-2ubuntu1.1 | UBUNTU-CVE-2025-13086 |
| Ubuntu:25.10 | openvpn | 2.6.14-2ubuntu1.1 | USN-7898-1 |
Affected products (as reported)
Weakness: CWE-940 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U