A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3596-1 advisory.

    - CVE-2026-11771: NTLM proxy auth stack off-by-one write (bsc#1273126).
    - CVE-2026-12932: memory leak using --tls-crypt-v2 (bsc#1273127).
    - CVE-2026-12996: Potential DoS and memory leak via TLS session use-after-free (bsc#1273128).
    - CVE-2026-13117: Heap use-after-free via incomplete guard in check_session_buf_not_used() (bsc#1273129).
    - CVE-2026-13379: Windows interactive service DNS SearchList state pollution (bsc#1273130).
    - CVE-2026-35058: improper validation of packet length can lead to a denial of service (bsc#1267945).
    - CVE-2026-40215: race condition during TLS session promotion can lead to a use-after-free (bsc#1267944).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the version of OpenVPN installed on the remote host is affected by a vulnerability:

  - A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to     potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session     promotion. (CVE-2026-40215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4653 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4653-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     June 27, 2026                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : openvpn     Version        : 2.5.1-3+deb11u3     CVE ID         : CVE-2026-35058 CVE-2026-40215

    Two security vulnerabilities were discovered in OpenVPN,a virtual     private network application.

    CVE-2026-35058

       Improper validation of packet length during tls-crypt-v2 key        extraction allows authenticated attackers to trigger a fatal        assertion and cause a denial of service via a specially crafted        packet.

    CVE-2026-40215

       A race condition allows remote attackers to potentially cause a server        crash or leak heap memory via a use-after-free triggered during TLS        session promotion.

    For Debian 11 bullseye, these problems have been fixed in version     2.5.1-3+deb11u3.

    We recommend that you upgrade your openvpn packages.

    For the detailed security status of openvpn please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openvpn

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6289 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6289-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 21, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : openvpn     CVE ID         : CVE-2026-35058 CVE-2026-40215

    Two security vulnerabilities were discovered in OpenVPN, which could     result in denial of service or a leak of packet data from a previous     handshake.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 2.6.14-0+deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 2.6.14-1+deb13u2.

    We recommend that you upgrade your openvpn packages.

    For the detailed security status of openvpn please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openvpn

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8286-1 advisory.

    Guannan Wang, Zhanpeng Liu, Guancheng Li, and Emma Reuter discovered that OpenVPN incorrectly handled     suitably malformed packets with valid tls-crypt-v2 keys. An attacker could possibly use this issue to     cause OpenVPN to crash, resulting in a denial of service. (CVE-2026-35058)

    Guannan Wang, Zhanpeng Liu, and Guancheng Li discovered that OpenVPN had a race condition in the TLS     handshake process that could leak packet data from a previous handshake under certain circumstances. An     attacker could possibly use this issue to obtain sensitive information. (CVE-2026-40215)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1644 advisory.

    According to upstream advisory (https://community.openvpn.net/Security%20Announcements/CVE-2026-35058):

    OpenVPN server crash via ASSERT triggered by malformed tls-crypt-v2 packet; attacker with a valid tls-     crypt-v2 client key can send a crafted control channel packet to crash the server (DoS). Fixed in 2.6.20     and 2.7.2. (CVE-2026-35058)

    In a race condition an old TLS session could still try to send a packet but also get replaced by a new     session. In this case, the buffer of the new session is still referenced. Add the     check_session_buf_not_used function to mitigate this problem. (CVE-2026-40215)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ddc5696c20 advisory.

    Update to upstream OpenVPN 2.6.20     CVE-2026-40215     CVE-2026-35058

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-086acf3001 advisory.

    Update to upstream 2.7.3 release

    ----

    Update to upstream 2.7.2 release     CVE-2026-40215     CVE-2026-35058

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-670067411c advisory.

    Update to upstream OpenVPN 2.6.20     CVE-2026-40215     CVE-2026-35058

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 549313db-3e93-11f1-8d38-7fbbe0285610 advisory.

    Gert Doering reports:
    [Security fixes in 2.7.2]

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to     potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session     promotion. (CVE-2026-40215)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335070	SUSE SLED15: openvpn / openvpn-auth-pam-plugin / openvpn-dco / openvpn-dco-devel / etc (SUSE-SU-2026:3596-1)	Nessus	SuSE Local Security Checks	Local	high
324955	OpenVPN 2.6.x < 2.6.20 / 2.7.x < 2.7.2 TLS Race Condition	Nessus	Windows	Local	medium
323101	Debian dla-4653 : openvpn - security update	Nessus	Debian Local Security Checks	Local	medium
316479	Debian dsa-6289 : openvpn - security update	Nessus	Debian Local Security Checks	Local	medium
316075	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenVPN vulnerabilities (USN-8286-1)	Nessus	Ubuntu Local Security Checks	Local	medium
315626	Amazon Linux 2023 : openvpn, openvpn-devel (ALAS2023-2026-1644)	Nessus	Amazon Linux Local Security Checks	Local	medium
311727	Fedora 42 : openvpn (2026-ddc5696c20)	Nessus	Fedora Local Security Checks	Local	critical
311105	Fedora 44 : openvpn (2026-086acf3001)	Nessus	Fedora Local Security Checks	Local	critical
310591	Fedora 43 : openvpn (2026-670067411c)	Nessus	Fedora Local Security Checks	Local	critical
310335	FreeBSD : OpenVPN -- server DOS and data leak in TLS handshake vulnerabilities (549313db-3e93-11f1-8d38-7fbbe0285610)	Nessus	FreeBSD Local Security Checks	Local	critical
309874	Linux Distros Unpatched Vulnerability : CVE-2026-40215	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-40215

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

critical

critical

critical

critical

medium