Detections
Analytics
CVE-2026-40215
medium
Description
A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.
References
https://community.openvpn.net/Security%20Announcements/CVE-2026-40215
https://community.openvpn.net/ReleaseHistory#openvpn-272-released-22-april-2026
https://community.openvpn.net/ReleaseHistory#openvpn-2620-released-22-april-2026
Details
Published: 2026-06-08
Updated: 2026-06-09
Risk Information
CVSS v2
Base Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P
Severity: Medium
CVSS v3
Base Score: 5.9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: Medium
CVSS v4
Base Score: 6.1
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L
Severity: Medium
EPSS
EPSS: 0.00138