CVE-2026-13122
Medium · 5.3CVSS
5.3
EPSS
—
Published
Jul 6, 2026
CISA due date
—
The record
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-617
- CVE-2026-105753 vLLM is an inference and serving engine for large language models. CWE-617
- CVE-2026-98151 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG… CWE-617
- CVE-2026-84450 libheif is a HEIF and AVIF file format decoder and encoder. CWE-617
- CVE-2026-8674 Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN… CWE-617
- CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the… CWE-617
- CVE-2026-76163 If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block… CWE-617
- CVE-2026-86317 A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. CWE-617