Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenVPN Security Update Fixes Multiple Critical Flaws
published 2 months ago
Summary
This security update addresses multiple critical vulnerabilities in OpenVPN that could allow hackers to disrupt service, steal sensitive information, or take control of your network. To protect your business, apply this update as soon as possible. Ensure you also follow best practices for secure configuration and regular backups.
What to do
- Update suse openvpn to version 2.6.10-150600.3.26.1.
- Update suse openvpn-dco to version 2.6.10-150600.3.26.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | suse | openvpn |
< 2.6.10-150600.3.26.1 Fix: upgrade to 2.6.10-150600.3.26.1
|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | suse | openvpn-dco |
< 2.6.10-150600.3.26.1 Fix: upgrade to 2.6.10-150600.3.26.1
|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | suse | openvpn |
< 2.6.10-150600.3.26.1 Fix: upgrade to 2.6.10-150600.3.26.1
|
| SUSE:Linux Enterprise Server 15 SP6-LTSS | suse | openvpn-dco |
< 2.6.10-150600.3.26.1 Fix: upgrade to 2.6.10-150600.3.26.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | suse | openvpn |
< 2.6.10-150600.3.26.1 Fix: upgrade to 2.6.10-150600.3.26.1
|
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | suse | openvpn-dco |
< 2.6.10-150600.3.26.1 Fix: upgrade to 2.6.10-150600.3.26.1
|
Original advisory text
Security update for openvpn
This update for openvpn fixes the following issues:
- CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
- CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
- CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
- CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
- CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
- CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
- CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
- CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
- CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
- CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
- CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
- CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
- CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
- CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20263596-1/ Vendor Advisory
- https://bugzilla.suse.com/1267944 Third Party Advisory
- https://bugzilla.suse.com/1267945 Third Party Advisory
- https://bugzilla.suse.com/1273126 Third Party Advisory
- https://bugzilla.suse.com/1273127 Third Party Advisory
- https://bugzilla.suse.com/1273128 Third Party Advisory
- https://bugzilla.suse.com/1273129 Third Party Advisory
- https://bugzilla.suse.com/1273130 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-11771 URL
- https://www.suse.com/security/cve/CVE-2026-12932 URL
- https://www.suse.com/security/cve/CVE-2026-12996 URL
- https://www.suse.com/security/cve/CVE-2026-13117 URL
- https://www.suse.com/security/cve/CVE-2026-13379 URL
- https://www.suse.com/security/cve/CVE-2026-35058 URL
- https://www.suse.com/security/cve/CVE-2026-40215 URL
Timeline
Published12 Aug 2026
Updated13 Aug 2026
First seen13 Aug 2026
Sources
SUSE-SU-2026:3596-1 · OSV
Track software like this
Free during beta