USN-8852-1: OpenVPN vulnerabilities

OpenVPN versions through 2.6.22 and through 2.7.6 contain an integer overflow (CWE-190) in the retransmission handling of ACK packet IDs, which can cause a timeout value to wrap. A remote, unauthenticated attacker who can reach a listening OpenVPN service can send crafted inputs that trigger the overflow, causing the service to time out or fail and disrupting VPN connectivity. The impact is availability-only; the CVSS 4.0 vector shows no confidentiality or integrity impact to the tunnel or data. All deployments running affected 2.6.x releases up to and including 2.6.22, or 2.7.x releases up to and including 2.7.6, are potentially exposed. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a 0.5% probability of exploitation in the next 30 days.

Do: Upgrade OpenVPN servers and clients to a fixed 2.6-series release newer than 2.6.22 or a fixed 2.7-series release newer than 2.7.6, per the OpenVPN security advisory (AV26-889). Until patched, restrict exposure of OpenVPN service ports to trusted source networks and monitor for unexpected process crashes or restarts. Operators of third-party products (appliances, router firmware) that bundle affected OpenVPN versions should apply vendor updates when they ship fixes.