CVE-2025-13086

Publication date 19 November 2025

Last updated 10 December 2025

Ubuntu priority

Description

Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openvpn	25.10 questing	Fixed 2.6.14-2ubuntu1.1
	25.04 plucky	Fixed 2.6.14-0ubuntu0.25.04.3
	24.04 LTS noble	Fixed 2.6.14-0ubuntu0.24.04.3
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Needs evaluation

Notes

mdeslaur

This only affects 2.6.0 through 2.6.15

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openvpn	Upstream: fa6a182

References

Related Ubuntu Security Notices (USN)

USN-7898-1
OpenVPN vulnerability
27 November 2025