CVE-2025-3110

OpenVPN / Access Server PUBLISHED

Description (CNA)

OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy

Affected (CNA)

Vendor / product	Versions
OpenVPN / Access Server	affected 2.7.2 through 3.1.0

CWE

CWE-444

References

https://openvpn.net/as-docs/as-3-2-release-notes.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.