Log in Start free

Vulnerability · Published Jun 8, 2026 · Assigned by OpenVPN

CVE-2026-35058

Medium 6.9

In plain English

A medium-severity security flaw in OpenVPN from OpenVPN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.5%top 54.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20openvpn2.6.20-r0ALPINE-CVE-2026-35058
Alpine:v3.21openvpn2.6.20-r0ALPINE-CVE-2026-35058
Alpine:v3.22openvpn2.6.20-r0ALPINE-CVE-2026-35058
Alpine:v3.23openvpn2.6.20-r0ALPINE-CVE-2026-35058
Alpine:v3.24openvpn2.6.20-r0ALPINE-CVE-2026-35058
Debian:12openvpn2.6.14-0+deb12u1DEBIAN-CVE-2026-35058
Debian:13openvpn2.6.14-1+deb13u2DEBIAN-CVE-2026-35058
Debian:14openvpn2.7.2-1DEBIAN-CVE-2026-35058
Ubuntu:22.04:LTSopenvpn2.5.11-0ubuntu0.22.04.3UBUNTU-CVE-2026-35058
Ubuntu:24.04:LTSopenvpn2.6.19-0ubuntu0.24.04.2UBUNTU-CVE-2026-35058
Ubuntu:25.10openvpn2.6.19-0ubuntu0.25.10.2UBUNTU-CVE-2026-35058
Ubuntu:26.04:LTSopenvpn2.7.0-1ubuntu1.1UBUNTU-CVE-2026-35058

Affected products (as reported)

VendorProductVersions
OpenVPN OpenVPN 2.6.0 – through 2.6.192.7_alpha1 – through 2.7.1

Weakness: CWE-617 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References