OpenVPN CVE-2026-84471 (CVSS 4.0 7.2): incomplete TLS session buffer guard can double-free in the lame-duck case; authenticated peer DoS or memory leak — upgrade to 2.6.23 or 2.7.7 (CVE published 14 Oct)

OpenVPN's CNA published CVE-2026-84471 on 14 October 2026 (CVE record datePublished 14:29 UTC). The community security announcement describes a possible double-free of a TLS session buffer in the lame-duck path because the guard in check_session_buf_not_used() was incomplete, extending the earlier work on CVE-2026-13117. The CVE description (also from OpenVPN) frames it as an incomplete fix for the related CVE-2026-12996 use-after-free and says a remote authenticated peer can cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry (CWE-416). OpenVPN rates it CVSS 4.0 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H). Affected lines in the CVE record are OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7; the vendor announcement says 2.6.0–2.6.22 and 2.7_alpha1–2.7.6 are affected and lists fixed builds 2.6.23 and 2.7.7. GitHub release notes for openvpn 2.6.23 (23 September 2026) explicitly credit the improved check_session_buf_not_used() / double-free lame-duck fix as CVE-2026-84471. No public exploitation is reported. Related earlier TLS-session memory issues on the same code path include CVE-2026-12996 (fixed in 2.6.21 / 2.7.5) and CVE-2026-13117.

Product

OpenVPN (community / openvpn 2.x)

Versions

CVE record: OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 affected. Vendor announcement: 2.6.0–2.6.22 and 2.7_alpha1–2.7.6 affected; fixed in 2.6.23 and 2.7.7. Prefer vendor fixed builds: upgrade to 2.6.23 or 2.7.7 (or your distro package that includes the CVE-2026-84471 fix).

CVSS

7.2 (OpenVPN CNA, CVSS 4.0 High)

Exploited in Australia?

unknown

Patch to

Upgrade OpenVPN to 2.6.23 or 2.7.7 (or the fixed package from your OS vendor). Servers still on 2.6.21–2.6.22 or 2.7.5–2.7.6 after the earlier CVE-2026-12996 fix still need this follow-up. Limit who can establish a VPN peer session, and restart openvpn after the upgrade.

Primary: OpenVPN community — CVE-2026-84471 security announcement (possible double-free in check_session_buf_not_used() lame duck handling; fixed 2.6.23 / 2.7.7) · Vendor: OpenVPN/openvpn v2.6.23 release notes (23 Sep 2026) — security fix for CVE-2026-84471; also see v2.7.7 · CVE: CVE-2026-84471, CVE-2026-13117, CVE-2026-12996 · CVE-2026-84471 record (OpenVPN CNA; datePublished 14 Oct 2026; CVSS 4.0 7.2); related CVE-2026-12996 advisory on the same wiki

vulnerabilities network