Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1312 advisory.

    HMAC verification check: fix incorrect memcmp() call

    NOTE: https://community.openvpn.net/Security%20Announcements/CVE-2025-13086 (CVE-2025-13086)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6069 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6069-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     December 03, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openvpn     CVE ID         : CVE-2025-13086     Debian Bug     : 1121086

    It was discovered that openvpn, a virtual private network application,     does not properly handle HMAC verification checks. A remote attacker can     take advantage of this flaw to bypass source IP address validation.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 2.6.3-1+deb12u4.

    For the stable distribution (trixie), this problem has been fixed in     version 2.6.14-1+deb13u1.

    We recommend that you upgrade your openvpn packages.

    For the detailed security status of openvpn please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/openvpn

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS / 25.04 / 25.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7898-1 advisory.

    Joshua Rogers discovered that OpenVPN incorrectly handled HMAC verification checks. A remote attacker     could possibly use this issue to bypass source IP address validation.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of openvpn installed on the remote host is prior to 2.6.16. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-323-01 advisory.

    New openvpn packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the openvpn security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through     2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the     connection resulting in a denial of service for the originating client (CVE-2025-13086)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 17a40d76-c3fd-11f0-b513-0da7be77c170 advisory.

    Arne Schwabe reports:
    Fix memcmp check for the hmac verification in the 3way handshake being inverted               This is a stupid mistake but causes all hmac cookies to be accepted,               thus breaking source IP address validation.   As a consequence, TLS               sessions can be openend and state can be consumed in the server from                 IP addresses that did not initiate an initial connection.
    While at it, fix check to only allow [t-2;t] timeslots, disallowing                 HMACs coming in from a future timeslot.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277812	Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2025-1312)	Nessus	Amazon Linux Local Security Checks	high
277384	Debian dsa-6069 : openvpn - security update	Nessus	Debian Local Security Checks	high
277320	Ubuntu 24.04 LTS / 25.04 / 25.10 : OpenVPN vulnerability (USN-7898-1)	Nessus	Ubuntu Local Security Checks	critical
275818	Slackware Linux 15.0 / current openvpn Vulnerability (SSA:2025-323-01)	Nessus	Slackware Local Security Checks	critical
275772	Linux Distros Unpatched Vulnerability : CVE-2025-13086	Nessus	Misc.	high
275731	FreeBSD : OpenVPN -- HMAC verification on source IP address ineffective (17a40d76-c3fd-11f0-b513-0da7be77c170)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2025-13086

high

Tenable Plugins

high

high

critical

critical

high

medium