CVE-2026-13698
Received
Received - Intake
Memory Leak in OpenVPN TLS-Crypt-V2 Client Key
Vulnerability report for CVE-2026-13698, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-06
Last updated on: 2026-07-06
Assigner: OpenVPN Inc.
Description
Description
A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openvpn | openvpn | From 2.5.0 (inc) to 2.5.11 (inc) |
| openvpn | openvpn | From 2.6.0 (inc) to 2.6.20 (inc) |
| openvpn | openvpn | From 2.7_alpha1 (inc) to 2.7.4 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
