CVE-2026-35058
Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allo...
Published: 2026-06-08 · Last updated: 2026-06-09
Severity and scoring
- CWE
- CWE-617
Description
Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-35058
- [Other]https://community.openvpn.net/ReleaseHistory#openvpn-2620-released-22-april-2026
- [Other]https://community.openvpn.net/ReleaseHistory#openvpn-272-released-22-april-2026
- [Other]https://community.openvpn.net/Security%20Announcements/CVE-2026-35058
- [Other]https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2381
Related CVEs
Same CWE
- CVE-2026-52718 — A denial of service vulnerability was found in GStreamer's AV1 codec parser in gst-plugins-bad (6.5 MEDIUM)
- CVE-2026-29116 — A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially crafted packet, ...
- CVE-2026-29115 — A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially crafted packet, tr...
- CVE-2026-46543 — Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm (5.3 MEDIUM)
- CVE-2026-46542 — Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm (4.3 MEDIUM)