High
Security advisory
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-7478
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:17 UTC · Revision 1
Source evidence
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.
osv:CVE-2017-7478
Complete source record
{
"id": "1df24a56f90837888ad490564966e130e938a6a1ac6a568f46b1e9ee53e2190a",
"url": "https://osv.dev/vulnerability/CVE-2017-7478",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-7478",
"summary": "OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.",
"evidence": "osv:CVE-2017-7478",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-7478",
"aliases": [
"CVE-2017-7478"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openvpn/openvpn",
"type": "GIT",
"events": [
{
"introduced": "8990b218fa9db71714ac42b0095c594e19861320"
},
{
"last_affected": "bb9d4c91c95f245dea87735e4e05661e04931b33"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openvpn:openvpn:2.3.12:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.12"
},
{
"last_affected": "2.3.12"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:openvpn:openvpn:2.3.13:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.13"
},
{
"last_affected": "2.3.13"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:openvpn:openvpn:2.3.14:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.3.14"
},
{
"last_affected": "2.3.14"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4.0"
},
{
"last_affected": "2.4.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.4.1"
},
{
"last_affected": "2.4.1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.3.12",
"2.3.13",
"2.3.14",
"2.4.0",
"2.4.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7478.json"
}
}
],
"modified": "2026-10-24T10:30:51.305920224Z",
"provider": "osv",
"references": [
"https://www.exploit-db.com/exploits/41993/",
"https://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:openvpn:openvpn:2.3.12:*:*:*:*:*:*:*",
"cpe:2.3:a:openvpn:openvpn:2.3.13:*:*:*:*:*:*:*",
"cpe:2.3:a:openvpn:openvpn:2.3.14:*:*:*:*:*:*:*",
"cpe:2.3:a:openvpn:openvpn:2.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:openvpn:openvpn:2.4.0:alpha2:*:*:*:*:*:*",
"cpe:2.3:a:openvpn:openvpn:2.4.0:beta1:*:*:*:*:*:*",
"cpe:2.3:a:openvpn:openvpn:2.4.0:beta2:*:*:*:*:*:*",
"cpe:2.3:a:openvpn:openvpn:2.4.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:openvpn:openvpn:2.4.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:openvpn:openvpn:2.4.1:*:*:*:*:*:*:*"
],
"vendor_product": "openvpn:openvpn",
"extracted_events": [
{
"range": [
{
"introduced": "2.3.12"
},
{
"last_affected": "2.3.12"
},
{
"introduced": "2.3.13"
},
{
"last_affected": "2.3.13"
},
{
"introduced": "2.3.14"
},
{
"last_affected": "2.3.14"
},
{
"introduced": "2.4.0"
},
{
"last_affected": "2.4.0"
},
{
"introduced": "2.4.0-alpha2"
},
{
"last_affected": "2.4.0-alpha2"
},
{
"introduced": "2.4.0-alpha2"
},
{
"last_affected": "2.4.0-alpha2"
},
{
"introduced": "2.4.0-beta1"
},
{
"last_affected": "2.4.0-beta1"
},
{
"introduced": "2.4.0-beta1"
},
{
"last_affected": "2.4.0-beta1"
},
{
"introduced": "2.4.0-beta2"
},
{
"last_affected": "2.4.0-beta2"
},
{
"introduced": "2.4.0-beta2"
},
{
"last_affected": "2.4.0-beta2"
},
{
"introduced": "2.4.0-rc1"
},
{
"last_affected": "2.4.0-rc1"
},
{
"introduced": "2.4.0-rc1"
},
{
"last_affected": "2.4.0-rc1"
},
{
"introduced": "2.4.0-rc2"
},
{
"last_affected": "2.4.0-rc2"
},
{
"introduced": "2.4.0-rc2"
},
{
"last_affected": "2.4.0-rc2"
},
{
"introduced": "2.4.1"
},
{
"last_affected": "2.4.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-7478",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437452,
"published_at": "2017-05-15T18:29:00.293+00:00"
}