Security fixes: reliability layer: avoid unbounded reliable TLS timeout, and ignore acks for packets that cannot be outstanding (CVE-2026-84732) Both reliability layer bugs found by Mark Bregman (Fox-IT) windows: fix CreateProcess() command line quoting for characters that are special to cmd.exe, where a combination of validation script plus rogue CA could lead to misbehavior (CVE-2026-84256) Bug…
Security fixes: openvpnserv (windows): better scrutinize command line passed in from the control socket to openvpn. This would lead to circumventing admin restrictions on allowed openvpn config directories (but never to "read files the user has no permissions for") (CVE-2026-63649) Bug found by 章鱼哥 (www.aipyaipy.com) dco: make key state desync recoverable This was reported as a "with suitable timi…
Security fixes: openvpnserv (windows): better scrutinize command line passed in from the control socket to openvpn. This would lead to circumventing admin restrictions on allowed openvpn config directories (but never to "read files the user has no permissions for") (CVE-2026-63649) Bug found by 章鱼哥 (www.aipyaipy.com) dco: make key state desync recoverable This was reported as a "with suitable timi…
Security fixes: openvpnserv (windows): fix DNS SearchList state pollution on (dis)connect. specific combinations of --dns config entries plus local DNS config could lead to corruption of pre-openvpn DNS config (CVE-2026-13379) Bug found by 章鱼哥 (www.aipyaipy.com). Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets (CVE-2026-12…
Security fixes: Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets (CVE-2026-12996) Bug found by multiple researchers: 章鱼哥 (www.aipyaipy.com) Haiyang Huang Haruki Oyama (Waseda University) Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable sequence of dynamic tls-crypt control-channel packets (CVE-2026-13117)…
Bugfixes: using --dns server ... style configs on Windows with win-dco would lead to erroneously enabling "DnsSecValidationRequired : True", possibly breaking VPN DNS resolution. Pushing --dns server ... dnssec no can be used as a workaround until clients can be updated. (Github: openvpn#1024) correct comments in the --dns-up-down platform scripts relating to dns_server_..._dnssec values. fix rele…
Bugfixes: in combination with --management-query-passwords, setups using --auth-user-pass file or inline auth-user-pass would no longer use the configured passwords and prompt on the management interface instead (OpenVPN GUI would then provide an empty user/password prompt) (Github: openpvn#1021). For details see Changes.rst Windows Client: Community MSI installer for Windows client can be found a…
Security fixes: CVE-2026-40215: fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances CVE-2026-35058: fix server ASSERT() on receiving a suitably malformed packet with a valid tls-crypt-v2 key New features: management interface: permit input of very long passwords in base64-encoded multiline format. Signal support to ma…
Security fixes: CVE-2026-40215: fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances CVE-2026-35058: fix server ASSERT() on receiving a suitably malformed packet with a valid tls-crypt-v2 key Bugfixes: management: stop periodic bytecount output on mgmt client disconnection FreeBSD: make DCO work on systems with no IPv4…
New features: Add a new username-only flag argument to --auth-user-pass which will now make OpenVPN only query for username and send a dummy password to the server. This is only useful if auth schemes are used on the server side that will do some sort of external challenge base on username, and not password authentication. See discussion in GH OpenVPN/openvpn#501 (starting Jan 30, 2024). Increase…
after branching off "release/2.7"
Highlights of 2.7 Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server Improved Client support for DNS options Client implementations for Linux/BSD/macOS, included with the default install New client implementation for Windows, adding support for features like split DNS and DNSSEC Architectural improvements on Windows The block-local flag is now enforced…
User visible changes disable DCO if --bind-dev option is given (no support for this in the old out-of-kernel Linux DCO implementation) on Windows, if using --ip-win32 netsh and not using the interactive service, IPv4 addresses would be installed as "permanent", possibly causing problems later on with using that IPv4 address on a different interface. Change to "store=active". (GH: #915) improve pul…
Arne Schwabe (1): Ensure that all unit tests use unbuffered stdout and stderr Brandon Currell (1): Add check for bind-dev in DCO options Frank Lichtenheld (6): configure: Try to use pkg-config to detect mbedTLS configure.ac: Remove use of PKCS11_HELPER_LIBS in mbedTLS checks tests: Allow to override openvpn binary used multi: Warn about failing read in multi_process_file_closed() tests/unit_tests:…