OpenVPN/openvpn v2.6.23

on GitHub

Security fixes:

• ssl: do not trust the peer's request to resend the wrapped client key

• reliability layer: avoid unbounded reliable TLS timeout, and ignore acks
  for packets that cannot be outstanding (CVE-2026-84732)

  Both reliability layer bugs found by Mark Bregman (Fox-IT)

• improve on check_session_buf_not_used(), catch possible double-free in
  the lame duck case (CVE-2026-84471)

  Bug reported by Andreas Gabriel Berbescu and Haruki Oyama (Waseda University)

• windows: fix CreateProcess() command line quoting for characters that
  are special to cmd.exe, where a combination of validation script plus
  rogue CA could lead to misbehavior (CVE-2026-84256)

  Bug found by Clouditera Security

• windows: fix tapctl to always call netsh.exe with full path
  (as we do elsewhere) (CVE-2026-84226)

  Bug found by BreachX Zero Day Labs (using Typhon AI Mil v2)

• windows: don't use NULL DACL with system objects, namely the --service
  exit event and the netsh.exe guard semaphore.

  The old approach was prone to a local DoS where one user could interfere
  with other users' openvpn processes by blocking the netsh semaphore or
  sending events. This only affects setups not using the iservice, or
  using the automatic service to start/stop openvpn (CVE-2026-82312)

  Bug found by DEBRAJ BASAK

• dhcp (windows): fix off-by-one in write_dhcp_search_str() temp buffer
  guard - suitable DHCP options could lead to a single-byte overflow of a
  temp buffer (CVE-2026-81738)

  Bug found by Andre Kropp (Nexory) and ChinhNguyen

• openvpnserv (windows): detect and refuse sibling dirs in CheckConfigPath()
  (CVE-2026-81830)

  Bug found by Harshit Varu

Full Changelog: v2.6.22...v2.6.23