openSUSE-SU-2026:22072-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22072-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22072-1
Upstream
CVE (9)
Related
CVE (9)
Published
2026-10-09T12:16:22Z
Modified
2026-10-19T17:23:12Z
Summary
Security update for openvpn
Details

This update for openvpn fixes the following issues:

  • CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
  • CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
  • CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
  • CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
  • CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
  • CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
  • CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).
  • CVE-2026-63650: OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field (bsc#1275310).
  • CVE-2026-84732: Remote Denial of Service via crafted ACK packets (bsc#1279613).
References

Affected packages

openSUSE:Leap 16.0 / openvpn

Package

Name
openvpn
Purl
pkg:rpm/opensuse/openvpn&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.6.10-160000.5.1

Ecosystem specific 

{
    "binaries":  [
        {
            "openvpn":  "2.6.10-160000.5.1",
            "openvpn-auth-pam-plugin":  "2.6.10-160000.5.1",
            "openvpn-devel":  "2.6.10-160000.5.1",
            "openvpn-down-root-plugin":  "2.6.10-160000.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22072-1.json"