OpenVPN 2.7.701

What's new in 2.7.701

Security fixes:
- reliability layer: avoid unbounded reliable TLS timeout, and ignore acks
for packets that cannot be outstanding (CVE-2026-84732)
Both reliability layer bugs found by Mark Bregman (Fox-IT)
- windows: fix CreateProcess() command line quoting for characters that
are special to cmd.exe, where a combination of validation script plus
rogue CA could lead to misbehavior (CVE-2026-84256)
Bug found by Clouditera Security
- windows: fix tapctl to always call netsh.exe with full path
(as we do elsewhere) (CVE-2026-84226)
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- windows: don't use NULL DACL with system objects, namely the --service
exit event and the netsh.exe guard semaphore.
The old approach was prone to a local DoS where one user could interfere
with other users' openvpn processes by blocking the netsh semaphore or
sending events. This only affects setups not using the iservice, or
using the automatic service to start/stop openvpn (CVE-2026-82312)
Bug found by DEBRAJ BASAK
- openvpnserv (windows): pass correct NRPT domains size - when IDN domains
with UTF8 encoding were involved, a buffer overread could be achieved
(CVE-2026-78221)
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- openvpnserv (windows): don't allow '/' in config paths.
The APIs windows uses for path validation do not handle '/' as path
separator, while the file open APIs do, so this could be used to
circumvent our config path validation, leading to openvpn.exe starting
a user-controlled config file even if administratively not allowed
(CVE-2026-78043)
Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)
- dhcp (windows): fix off-by-one in write_dhcp_search_str() temp buffer
guard - suitable DHCP options could lead to a single-byte overflow of a
temp buffer (CVE-2026-81738)
Bug found by Andre Kropp (Nexory) and ChinhNguyen
- linux netlink: validate netlink replies against the request
Suggested by Joshua Rogers as a security improvement
- openvpnserv (windows): fix off-by-one on input validation
(discovered while fixing CVE-2026-78221)
- openvpnserv (windows): harden CheckConfigPath() a bit more
(another improvement while working on CVE-2026-78043)
User-visible Changes:
- when using EPOCH data channel format, reduce the number of future keys
from 16 to 4 - the previous calculation was wrong, and 4 spare keys are
sufficient for 100+ Gbit/s links. This means less log spam in userland …

Full release notes »