CVE-2026-84471

OpenVPN / OpenVPN PUBLISHED

Description (CNA)

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.

Affected (CNA)

Vendor / product	Versions
OpenVPN / OpenVPN	affected 2.6.0 through 2.6.22; affected 2.7_alpha1 through 2.7.7

CWE

CWE-416

References

https://community.openvpn.net/Security%20Announcements/CVE-2026-84471

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.