CVE-2026-40215
A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash...
Published: 2026-06-08 · Last updated: 2026-06-09
Severity and scoring
- CWE
- CWE-125, CWE-416
Description
A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory via a use-after-free triggered during TLS session promotion.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-40215
- [Other]https://community.openvpn.net/ReleaseHistory#openvpn-2620-released-22-april-2026
- [Other]https://community.openvpn.net/ReleaseHistory#openvpn-272-released-22-april-2026
- [Other]https://community.openvpn.net/Security%20Announcements/CVE-2026-40215
Related CVEs
Same CWE
- CVE-2026-4367 — A flaw was found in libXpm (5.5 MEDIUM)
- CVE-2026-47963 — DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me... (5.5 MEDIUM)
- CVE-2026-47934 — DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me... (5.5 MEDIUM)
- CVE-2026-47927 — DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive me... (5.5 MEDIUM)
- CVE-2026-47748 — stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inf... (5.5 MEDIUM)