Full Report
OpenVPN security advisory (AV26-889)
Analysis Summary
# Vulnerability: OpenVPN Reliability Layer Unbounded TLS Timeout
## CVE Details
- **CVE ID:** CVE-2026-84732
- **CVSS Score:** Not explicitly listed in the advisory (Estimated High based on DoS potential)
- **CWE:** CWE-400 (Uncontrolled Resource Consumption) / CWE-835 (Loop with Unreachable Exit Condition)
## Affected Systems
- **Products:** OpenVPN (Community Edition and likely derivatives)
- **Versions:**
- Versions prior to and including **2.6.22**
- Versions prior to and including **2.7.6**
- **Configurations:** Systems utilizing the OpenVPN reliability layer for TLS handshakes (standard UDP configurations).
## Vulnerability Description
The vulnerability exists within the OpenVPN "reliability layer," which manages the delivery of TLS control channel packets over unreliable transports like UDP. Specifically, the flaw involves an unbounded TLS timeout mechanism and the improper handling of ACKs (acknowledgments) for packets that are not currently outstanding. An attacker can potentially manipulate the state of the reliability layer to cause excessive resource consumption or a hang, leading to a Denial of Service (DoS) of the VPN service.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; PoC status is restricted (Vendor discovered/reported).
- **Complexity:** Medium
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** None
- **Integrity:** None
- **Availability:** High (Can result in service disruption or connection hangs)
## Remediation
### Patches
The vendor has released updates to address this vulnerability. Users should upgrade to the following versions or higher:
- **OpenVPN v2.6.23** (or the latest stable in the 2.6.x branch)
- **OpenVPN v2.7.7** (or the latest stable in the 2.7.x branch)
### Workarounds
- **Switch to TCP:** While not always optimal for performance, using TCP (`proto tcp`) instead of UDP bypasses the custom OpenVPN reliability layer, as TCP handles packet ordering and retransmission at the transport level.
- **Access Control:** Restrict access to the OpenVPN port (default 1194) to known peer IPs using firewall/ACLs where possible.
- **Use `tls-auth` or `tls-crypt`:** Ensuring these features are enabled can help mitigate unauthorized packets from reaching the reliability layer state machine.
## Detection
- **Indicators of Compromise:** Unusual spikes in CPU usage for the OpenVPN process or a rapid increase in memory consumption associated with a specific remote IP.
- **Logs:** Look for repeated "TLS Error" or "Reliability Layer" related errors in the OpenVPN logs that do not result in a successful connection.
## References
- **Vendor Advisory:** hxxps[://]community[.]openvpn[.]net/Security%20Announcements/CVE-2026-84732
- **OpenVPN Security Updates:** hxxps[://]openvpn[.]net/security-advisories/
- **Cyber Centre Advisory:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/openvpn-security-advisory-av26-889