BSD Portsopenvpn -- multiple vulnerabilities
· CVE-2026-11771, CVE-2026-12932, CVE-2026-12996, CVE-2026-13117, CVE-2026-13122, CVE-2026-13698 · VuXML entry
The OpenVPN community project team reports: [...] OpenVPN 2.7.5 [...] is a bugfix release fixing several security issues: Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets (CVE-2026-12996) Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable sequence of dynamic tls-crypt control-channel packets (CVE-2026-13117) Fix server crash …
Affected versions
- openvpn < 2.7.5
- openvpn-devel < g20260701,2
By system
1 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | security/openvpn | 2.6.14 | vulnerable since 2026-07-01 | |
| OpenBSD | net/openvpn | 2.7.8 | out of range, by version | |
| NetBSD | net/openvpn | 2.7.7 | not listed | |
| MidnightBSD | security/openvpn | 2.6.14_1 | in range, by version | |
| FreeBSD | security/openvpn | 2.7.8 | fixed | |
| FreeBSD | security/openvpn-devel | g20260907,2 | fixed | (24 days after) |