CVE-2026-39312

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-39312

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39312.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-39312

Aliases

GHSA-q5g3-qhc6-pr3h

Published

2026-04-07T16:52:08.172Z

Modified

2026-07-15T01:49:16.717061138Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Pre-Auth EAP-TLS DoS on SoftEther VPN Developer Edition

Details

SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. In 5.2.5188 and earlier, a pre-authentication denial-of-service vulnerability exists in SoftEther VPN Developer Edition 5.2.5188 (and likely earlier versions of Developer Edition). An unauthenticated remote attacker can crash the vpnserver process by sending a single malformed EAP-TLS packet over raw L2TP (UDP/1701), terminating all active VPN sessions.

Database specific

{
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39312.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/softethervpn/softethervpn

Affected ranges

Type

GIT

Repo

https://github.com/softethervpn/softethervpn

Events

Introduced

Last affected

10d6efcc5e3329e5a959a99c6e939648f41121bf

Database specific

{
    "cpe": "cpe:2.3:a:softether:softethervpn:*:*:*:*:developer:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "5.2.5188"
        }
    ]
}

Affected versions

5.*

5.01.9658

5.01.9659

5.01.9660

5.01.9661

5.01.9662

5.01.9663

5.01.9664

5.01.9665

5.01.9666

5.01.9667

5.01.9668

5.01.9669

5.01.9670

5.01.9671

5.01.9672

5.01.9673

5.01.9674

5.02.0

5.02.5180

5.02.5181

5.02.5182

5.02.5183

5.02.5184

5.02.5185

5.02.5186

5.02.5187

5.2.5188

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39312.json"