OpenVPN Vulnerabilities Lead to Denial of Service Risks

Severity: Medium (Score: 57.8)

Sources: launchpad.net, Ubuntu, Linuxsecurity

Published: 2026-05-21 · Updated: 2026-05-21

Keywords: ubuntu, openvpn, vulnerabilities, security, issue, suffers, moderate

Severity indicators: vulnerabilities, issue, security issue, rat

Summary

OpenVPN has been found to have multiple vulnerabilities that could lead to denial of service and sensitive data leakage. Discovered by researchers Guannan Wang, Zhanpeng Liu, Guancheng Li, and Emma Reuter, these issues affect several Ubuntu releases, including 26.04 LTS and earlier versions. The first vulnerability (CVE-2026-35058) allows attackers to crash OpenVPN by sending malformed packets. The second vulnerability (CVE-2026-40215) involves a race condition in the TLS handshake process, which could leak sensitive packet data. Users are advised to update their systems to mitigate these risks. The vulnerabilities were disclosed on May 20, 2026, and patches are available through standard system updates. Key Points: • OpenVPN vulnerabilities could lead to denial of service and data leakage. • Affected Ubuntu versions include 26.04 LTS, 25.10, and 24.04 LTS. • Users should update their systems to the latest package versions to mitigate risks.

Detailed Analysis

**Impact** OpenVPN users across multiple Ubuntu releases—including 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS—are affected by vulnerabilities that can cause denial of service or data leakage. The issues potentially disrupt VPN connectivity, impacting business operations reliant on secure remote access. Sensitive handshake data may be exposed, risking confidentiality in sectors using OpenVPN for secure communications globally. No specific numbers or sectors were provided. **Technical Details** Two vulnerabilities were identified: CVE-2026-35058 allows denial of service via malformed packets with valid tls-crypt-v2 keys causing OpenVPN to crash, and CVE-2026-40215 involves a race condition in the TLS handshake that can leak packet data. The attack vector involves sending crafted packets during the TLS handshake phase. No malware or additional tools were mentioned, and no IOCs were provided. These issues occur during the TLS handshake stage of the kill chain. **Recommended Response** Apply the updated OpenVPN packages provided for affected Ubuntu versions immediately: 2.7.0-1ubuntu1.1 for 26.04 LTS, 2.6.19-0ubuntu0.25.10.2 for 25.10, 2.6.19-0ubuntu0.24.04.2 for 24.04 LTS, and 2.5.11-0ubuntu0.22.04.3 for 22.04 LTS. Conduct standard system updates to ensure all patches are applied. Monitor VPN service logs for unusual connection failures or handshake errors. No specific detection signatures or indicators were provided.

Source articles (3)

• Ubuntu 26.04 OpenVPN Suffers Moderate Denial of Service Vulnerabilities — Linuxsecurity · 2026-05-20
  A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: Several security issues were fixed in OpenVPN. S…
• Openvpn — launchpad.net · 2026-05-20
  openvpn: virtual private network daemon openvpn-dbgsym: debug symbols for openvpn This package has 7 new bugs and 0 open questions. * actual publishing details may vary in this distribution, these are…
• USN-8286-1: OpenVPN vulnerabilities — Ubuntu · 2026-05-20
  Guannan Wang, Zhanpeng Liu, Guancheng Li, and Emma Reuter discovered that OpenVPN incorrectly handled suitably malformed packets with valid tls-crypt-v2 keys. An attacker could possibly use this issue…

Timeline

• 2026-05-20 — OpenVPN vulnerabilities disclosed: Researchers reported vulnerabilities in OpenVPN, including denial of service and data leakage risks. Users are urged to update their systems.
• 2026-05-20 — Ubuntu security notice USN-8286-1 issued: Ubuntu released a security notice detailing vulnerabilities in OpenVPN affecting multiple LTS versions.

CVEs

• CVE-2026-35058
• CVE-2026-40215

Related entities

• Data Breach (Attack Type)
• DDoS (Attack Type)
• Denial of Service (Attack Type)
• CWE-200 - Exposure of Sensitive Information (Cwe)
• Cwe-362 - Race Condition (Cwe)
• OpenVPN (Platform)
• Ubuntu (Company)