CVE-2025-2704: OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying…

PriorityP341high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.81%

53.0th percentile

OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	openvpn	< openvpn 2.6.3-1+deb12u3 (bookworm)	openvpn 2.6.3-1+deb12u3 (bookworm)
openvpn	openvpn	>= 0 < 2.6.3-1+deb12u3	2.6.3-1+deb12u3
openvpn	openvpn	>= 0 < 2.6.14-1	2.6.14-1
openvpn	openvpn	>= 0 < 2.6.14-1	2.6.14-1
openvpn	openvpn	2.6.1 – 2.6.13	—

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv7.5HIGH

vendor_debian7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.