CVE catalog
CVE-2005-2531
openvpn: CVE-2005-2531
- Severity
- Critical
- Published
- Aug 24, 2005
- EPSS
- 1.97% · Oct 22, 2026
OpenVPN before 2.0.1, when running with "verb 0" and without TLS authentication, does not properly flush the OpenSSL error queue when a client fails certificate authentication to the server and causes the error to be processed by the wrong client, which allows remote attackers to cause a denial of service (client disconnection) via a large number of failed authentication attempts.
Packages
[Debian 12 (Bookworm)]
- [openvpn]Fixed
Details (4)
2.6.14-0+deb12u2· amd64 · bookwormFixed · Fixed:
2.0.2-1dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12
2.6.14-0+deb12u2· arm64 · bookwormFixed · Fixed:
2.0.2-1dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12
2.6.14-0+deb12u2· amd64 · bookworm-securityFixed · Fixed:
2.0.2-1dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12
2.6.14-0+deb12u2· arm64 · bookworm-securityFixed · Fixed:
2.0.2-1dsa · openvpn · debian · bookworm; dsa · openvpn · debian · 12
[Debian 13 (Trixie)]
- [openvpn]Fixed
Details (6)
2.6.14-1+deb13u3· amd64 · trixieFixed · Fixed:
2.0.2-1dsa · openvpn · debian · 13
2.6.14-1+deb13u3· arm64 · trixieFixed · Fixed:
2.0.2-1dsa · openvpn · debian · 13
2.7.5-1~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
2.0.2-1dsa · openvpn · debian · 13
2.7.5-1~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
2.0.2-1dsa · openvpn · debian · 13
2.6.14-1+deb13u3· amd64 · trixie-securityFixed · Fixed:
2.0.2-1dsa · openvpn · debian · 13
2.6.14-1+deb13u3· arm64 · trixie-securityFixed · Fixed:
2.0.2-1dsa · openvpn · debian · 13
Observed: Oct 23, 2026