CVE-2025-13086
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Dec 3, 2025
CISA due date
—
The record
Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | openvpn | 0 | 2.6.10-150600.3.20.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | openvpn-dco | 0 | 2.6.10-150600.3.20.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openvpn | 0 | 2.6.10-150600.3.20.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | openvpn-dco | 0 | 2.6.10-150600.3.20.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openvpn | 0 | 2.6.10-150600.3.20.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | openvpn-dco | 0 | 2.6.10-150600.3.20.1 |
| openSUSE:Leap 15.6 | openvpn | 0 | 2.6.10-150600.3.20.1 |
| openSUSE:Leap 15.6 | openvpn-dco | 0 | 2.6.10-150600.3.20.1 |
| openSUSE:Leap 16.0 | openvpn | 0 | 2.6.10-160000.3.1 |