Access Server vulnerabilities

3 known vulnerabilities in Access Server from OpenVPN. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Access Server: Inconsistent Interpretation of HTTP Requests

  CVE-2025-3110Jul 8, 2026OpenVPN

  OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy

• 9.8 Critical severity

  OpenVPN 2 (Community): Use After Free

  CVE-2023-46850Nov 11, 2023OpenVPNEPSS 2.31%

  Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.

• 7.5 High severity

  OpenVPN 2 (Community): Divide By Zero

  CVE-2023-46849Nov 11, 2023OpenVPNEPSS 1.36%

  Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.