CVE-2025-13086

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13086", "assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "state": "PUBLISHED", "assignerShortName": "OpenVPN", "dateReserved": "2025-11-12T19:37:55.606Z", "datePublished": "2025-12-03T19:54:10.737Z", "dateUpdated": "2025-12-12T13:50:46.678Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "shortName": "OpenVPN", "dateUpdated": "2025-12-12T13:50:46.678Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-940", "description": "CWE-940: Improper Verification of Source of a Communication Channel", "type": "CWE"}]}], "affected": [{"vendor": "OpenVPN", "product": "OpenVPN", "versions": [{"status": "affected", "version": "2.6.0", "lessThanOrEqual": "2.6.15", "versionType": "semver"}, {"status": "affected", "version": "2.7_alpha1", "lessThanOrEqual": "2.7_rc1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client"}], "references": [{"url": "https://community.openvpn.net/Security%20Announcements/CVE-2025-13086", "tags": ["vendor-advisory"]}, {"url": "https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00152.html", "tags": ["release-notes"]}, {"url": "https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00151.html", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "baseSeverity": "MEDIUM", "baseScore": 4.6, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T21:48:54.419203Z", "id": "CVE-2025-13086", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T21:49:07.801Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13086", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T21:48:54.419203Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T21:49:02.639Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OpenVPN", "product": "OpenVPN", "versions": [{"status": "affected", "version": "2.6.0", "versionType": "semver", "lessThanOrEqual": "2.6.15"}, {"status": "affected", "version": "2.7_alpha1", "versionType": "semver", "lessThanOrEqual": "2.7_rc1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://community.openvpn.net/Security%20Announcements/CVE-2025-13086", "tags": ["vendor-advisory"]}, {"url": "https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00152.html", "tags": ["release-notes"]}, {"url": "https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00151.html", "tags": ["release-notes"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-940", "description": "CWE-940: Improper Verification of Source of a Communication Channel"}]}], "providerMetadata": {"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "shortName": "OpenVPN", "dateUpdated": "2025-12-12T13:50:46.678Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13086", "state": "PUBLISHED", "dateUpdated": "2025-12-12T13:50:46.678Z", "dateReserved": "2025-11-12T19:37:55.606Z", "assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "datePublished": "2025-12-03T19:54:10.737Z", "assignerShortName": "OpenVPN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OpenVPN", "vendor": "OpenVPN", "versions": [{"lessThanOrEqual": "2.6.15", "status": "affected", "version": "2.6.0", "versionType": "semver"}, {"lessThanOrEqual": "2.7_rc1", "status": "affected", "version": "2.7_alpha1", "versionType": "semver"}]}], "source": "security@openvpn.net"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openvpn:openvpn:*:*:*:*:community:*:*:*", "matchCriteriaId": "61429F75-3DE9-499D-B00B-407E476A7B0F", "versionEndExcluding": "2.6.16", "versionStartIncluding": "2.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.7:alpha1:*:*:community:*:*:*", "matchCriteriaId": "474A2F74-9D40-437D-B71A-43A8A26C2A55", "vulnerable": true}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.7:alpha2:*:*:community:*:*:*", "matchCriteriaId": "1F5B810E-3614-4332-9281-B2AA28BD9403", "vulnerable": true}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.7:alpha3:*:*:community:*:*:*", "matchCriteriaId": "2A423301-191A-4578-B824-22024A225C1C", "vulnerable": true}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.7:beta1:*:*:community:*:*:*", "matchCriteriaId": "537BC1B1-7E25-48A0-9750-443E6774FD97", "vulnerable": true}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.7:beta2:*:*:community:*:*:*", "matchCriteriaId": "387E2C7F-C16A-49FA-827B-642BA760320D", "vulnerable": true}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.7:beta3:*:*:community:*:*:*", "matchCriteriaId": "183C57B8-5F1E-44E8-8B8A-5FBCDB926F21", "vulnerable": true}, {"criteria": "cpe:2.3:a:openvpn:openvpn:2.7:rc1:*:*:community:*:*:*", "matchCriteriaId": "113A4E81-FF15-4E70-8DE5-E82AA3FB1D79", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client"}, {"lang": "es", "value": "La validaci\u00f3n incorrecta de las direcciones IP de origen en OpenVPN versi\u00f3n 2.6.0 hasta 2.7_rc1 permite a un atacante abrir una sesi\u00f3n desde una direcci\u00f3n IP diferente que no inici\u00f3 la conexi\u00f3n, resultando en una denegaci\u00f3n de servicio para el cliente de origen."}], "id": "CVE-2025-13086", "lastModified": "2026-09-25T23:10:00.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@openvpn.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13086", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-03T21:48:54.419203Z", "version": "2.0.3"}}]}, "published": "2025-12-03T20:16:24.353", "references": [{"source": "security@openvpn.net", "tags": ["Vendor Advisory"], "url": "https://community.openvpn.net/Security%20Announcements/CVE-2025-13086"}, {"source": "security@openvpn.net", "tags": ["Mailing List", "Release Notes"], "url": "https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00151.html"}, {"source": "security@openvpn.net", "tags": ["Mailing List", "Release Notes"], "url": "https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00152.html"}], "sourceIdentifier": "security@openvpn.net", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-940"}], "source": "security@openvpn.net", "type": "Secondary"}]}

{"bugzilla": {"description": "OpenVPN: OpenVPN: Improper validation of source IP addresses leads to denial of service", "id": "2418671", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418671"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-940", "details": ["Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a different IP address which did not initiate the connection resulting in a denial of service for the originating client", "A flaw was found in OpenVPN. This vulnerability allows a denial of service (DoS) for the originating client via improper validation of source Internet Protocol (IP) addresses, allowing an attacker to open a session from a different IP address which did not initiate the connection."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2025-13086", "public_date": "2025-12-03T19:54:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-13086\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-13086\nhttps://community.openvpn.net/Security%20Announcements/CVE-2025-13086\nhttps://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00151.html\nhttps://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00152.html"], "statement": "This vulnerability is rated Moderate for Red Hat. Improper validation of source IP addresses in OpenVPN allows an attacker to open a session from a different IP address, leading to a denial of service for the originating client. This affects OpenVPN deployments where client source IP address validation is critical for session integrity.", "threat_severity": "Moderate"}

{"created": "2025-12-04T16:44:00.363587+00:00", "updated": "2025-12-04T16:44:00.363620+00:00", "vendors": ["openvpn", "openvpn$PRODUCT$openvpn"]}