CVE-2026-40215 — Vulnetix

CVE-2026-40215 PUBLISHED CVSS 6.1 MEDIUM

Reported by OpenVPN · Published June 8, 2026

A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

Risk Scores

CVSS v4.0

6.1

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L

Affected Products

Vendor	Product	Versions
OpenVPN	OpenVPN	2.6.0, 2.7_alpha1
alpine	openvpn	0, 0, 0
OpenVPN	OpenVPN	2.6.0, 2.7_alpha1

Timeline

Apr 23, 2026 CVE Published
Jun 9, 2026 Coalition ESS Score

References

vendor-advisory
release-notes
release-notes

Open in Interactive Console →