1 mentions in 7 days · 2 in 30 days · 2 total · first seen · last
Ubuntu warns OpenVPN flaws could allow remote code execution or denial of service.
Ubuntu published USN-8852-1 for two OpenVPN vulnerabilities. CVE-2026-84471 is a use-after-free in TLS session handling that could crash OpenVPN or allow arbitrary code execution. CVE-2026-84732 is an integer overflow triggered by retransmitted ACK packet IDs that a remote attacker could use for denial of service. The notice does not say either flaw is being exploited.
Canada's Cyber Centre advisory AV26-889 flags CVE-2026-84732 in OpenVPN 2.6.22 and earlier and 2.7.6 and earlier, urging administrators to apply updates.
The Canadian Centre for Cyber Security issued advisory AV26-889 noting that OpenVPN versions up to and including 2.6.22 and 2.7.6 are affected by CVE-2026-84732. The flaw involves unbounded TLS timeouts and acknowledgements for non-outstanding packets in the reliability layer. Administrators are encouraged to review the linked OpenVPN guidance and apply updates as they become available. No exploitation is reported.