Debian Linux - openvpn - None

Ubuntu Linux - race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances

The remote Debian 12 / 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6289 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6289-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 21, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openvpn     CVE ID         : CVE-2026-35058 CVE-2026-40215

    Two security vulnerabilities were discovered in OpenVPN, which could     result in denial of service or a leak of packet data from a previous     handshake.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 2.6.14-0+deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 2.6.14-1+deb13u2.

    We recommend that you upgrade your openvpn packages.

    For the detailed security status of openvpn please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openvpn

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8286-1 advisory.

    Guannan Wang, Zhanpeng Liu, Guancheng Li, and Emma Reuter discovered that OpenVPN incorrectly handled     suitably malformed packets with valid tls-crypt-v2 keys. An attacker could possibly use this issue to     cause OpenVPN to crash, resulting in a denial of service. (CVE-2026-35058)

    Guannan Wang, Zhanpeng Liu, and Guancheng Li discovered that OpenVPN had a race condition in the TLS     handshake process that could leak packet data from a previous handshake under certain circumstances. An     attacker could possibly use this issue to obtain sensitive information. (CVE-2026-40215)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1644 advisory.

    According to upstream advisory (https://community.openvpn.net/Security%20Announcements/CVE-2026-35058):

    OpenVPN server crash via ASSERT triggered by malformed tls-crypt-v2 packet; attacker with a valid tls-     crypt-v2 client key can send a crafted control channel packet to crash the server (DoS). Fixed in 2.6.20     and 2.7.2. (CVE-2026-35058)

    In a race condition an old TLS session could still try to send a packet but also get replaced by a new     session. In this case, the buffer of the new session is still referenced. Add the     check_session_buf_not_used function to mitigate this problem. (CVE-2026-40215)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ddc5696c20 advisory.

    Update to upstream OpenVPN 2.6.20     CVE-2026-40215     CVE-2026-35058

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-086acf3001 advisory.

    Update to upstream 2.7.3 release

    ----

    Update to upstream 2.7.2 release     CVE-2026-40215     CVE-2026-35058

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-670067411c advisory.

    Update to upstream OpenVPN 2.6.20     CVE-2026-40215     CVE-2026-35058

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 549313db-3e93-11f1-8d38-7fbbe0285610 advisory.

    Gert Doering reports:
    [Security fixes in 2.7.2]

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Gert Doering reports: [Security fixes in 2.7.2] (CVE-2026-40215)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
316479	Debian dsa-6289 : openvpn - security update	Nessus	Debian Local Security Checks	medium
316075	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenVPN vulnerabilities (USN-8286-1)	Nessus	Ubuntu Local Security Checks	medium
315626	Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-1644)	Nessus	Amazon Linux Local Security Checks	medium
311727	Fedora 42 : openvpn (2026-ddc5696c20)	Nessus	Fedora Local Security Checks	critical
311105	Fedora 44 : openvpn (2026-086acf3001)	Nessus	Fedora Local Security Checks	critical
310591	Fedora 43 : openvpn (2026-670067411c)	Nessus	Fedora Local Security Checks	critical
310335	FreeBSD : OpenVPN -- server DOS and data leak in TLS handshake vulnerabilities (549313db-3e93-11f1-8d38-7fbbe0285610)	Nessus	FreeBSD Local Security Checks	critical
309874	Linux Distros Unpatched Vulnerability : CVE-2026-40215	Nessus	Misc.	high

Detections

Analytics

CVE-2026-40215

medium

Tenable Plugins

medium

medium

medium

critical

critical

critical

critical

high