CVE-2026-84732: OpenVPN DOS Vulnerability

CVE-2026-84732 Overview

CVE-2026-84732 is a denial of service vulnerability in OpenVPN affecting versions through 2.6.22 and 2.7.6. The flaw resides in the handling of ACK packet ID retransmissions, where crafted inputs trigger an integer overflow in the timeout calculation logic. Remote unauthenticated attackers can exploit this weakness across the network to disrupt OpenVPN service availability. The vulnerability is classified under [CWE-190] (Integer Overflow or Wraparound) and impacts a widely deployed open-source VPN daemon used for site-to-site and remote-access tunnels.

Critical Impact
Remote unauthenticated attackers can crash or destabilize OpenVPN servers by sending crafted ACK retransmissions that trigger a timeout integer overflow.

Affected Products

OpenVPN versions through 2.6.22
OpenVPN versions through 2.7.6
Deployments exposing the OpenVPN control channel to untrusted networks

Discovery Timeline

2026-09-07 - CVE-2026-84732 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84732

Vulnerability Analysis

OpenVPN uses reliable transport for control channel messages, and each control packet carries an acknowledgment (ACK) packet identifier. When the peer retransmits ACK packet IDs, OpenVPN recalculates retransmission timeouts using arithmetic that does not adequately bound intermediate values. A crafted sequence of retransmissions causes the timeout computation to overflow, producing invalid scheduling values. The resulting state disrupts the reliability layer and leads to service unavailability. Because the flaw is reachable before session authentication completes, attackers do not need valid credentials or an established tunnel to trigger it.

Root Cause

The root cause is an integer overflow [CWE-190] in the timeout logic invoked during ACK packet ID retransmission handling. Arithmetic on retransmission counters or timestamps wraps around, yielding out-of-range timeout values that the reliability layer cannot process safely.

Attack Vector

Exploitation requires only network reachability to a listening OpenVPN endpoint. An attacker sends crafted control channel packets that generate the specific retransmission pattern needed to overflow the timeout arithmetic. No authentication, user interaction, or prior session establishment is required. See the OpenVPN Security Announcement CVE-2026-84732 for protocol-level details.

Detection Methods for CVE-2026-84732

Indicators of Compromise

Unexpected OpenVPN daemon restarts, crashes, or hangs on openvpn server processes without a corresponding administrative action.
Repeated inbound UDP or TCP connections to the OpenVPN listener port (default 1194) from a single source that never complete TLS handshake.
Bursts of duplicated ACK packet IDs observed in openvpn verbose logs at verbosity level 4 or higher.

Detection Strategies

Monitor openvpn process availability and restart counts through host telemetry to catch service disruption early.
Inspect packet captures on the OpenVPN listener for anomalous retransmission patterns of control channel ACK packets.
Correlate spikes in half-open control channel sessions with client source IPs to identify abusive peers.

Monitoring Recommendations

Alert when the OpenVPN service exits abnormally or fails a health check within a short interval.
Track connection rates per source IP against the OpenVPN port and flag sources exceeding baseline thresholds.
Forward OpenVPN logs to a centralized logging platform and alert on repeated TLS Error or reliability layer warnings.

How to Mitigate CVE-2026-84732

Immediate Actions Required

Inventory all OpenVPN servers and clients running versions at or below 2.6.22 and 2.7.6.
Upgrade to a fixed OpenVPN release as identified in the OpenVPN Security Announcement CVE-2026-84732.
Restrict network exposure of OpenVPN listeners to known client ranges where operationally feasible.

Patch Information

OpenVPN has published a security advisory tracking the fix for CVE-2026-84732. Administrators should follow the vendor guidance in the OpenVPN Security Announcement and deploy the corrected packages from their Linux distribution or the official OpenVPN builds. Restart the openvpn service after upgrading to ensure the patched binary is loaded.

Workarounds

Place OpenVPN servers behind tls-crypt or tls-crypt-v2 to require a pre-shared key before control channel processing.
Apply firewall rules to limit source IP ranges permitted to reach the OpenVPN listener port.
Enable rate limiting on the OpenVPN listener at the network edge to slow crafted retransmission floods.

bash

# Configuration example: require tls-crypt to gate control channel access
# Server configuration snippet
tls-crypt /etc/openvpn/server/tls-crypt.key
proto udp
port 1194
verb 4

# Generate the tls-crypt key on the server
openvpn --genkey secret /etc/openvpn/server/tls-crypt.key