CVE catalog
CVE-2026-106017
UBUNTU-CVE-2026-106017
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.20% · Oct 25, 2026
Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage restrictions.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | openvpn3-client | 13 | 24.1+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 13 | 25+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 13 | 25+dfsg-2 | vulnerable |
| Debian | openvpn3-client | 13 | 25+dfsg-3 | vulnerable |
| Debian | openvpn3-client | 13 | 25+dfsg-4 | vulnerable |
| Debian | openvpn3-client | 13 | 26+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 13 | 26+dfsg-2 | vulnerable |
| Debian | openvpn3-client | 13 | 27+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 13 | 27.1+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 13 | 27.1+dfsg-2 | vulnerable |
| Debian | openvpn3-client | 14 | 24.1+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 14 | 25+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 14 | 25+dfsg-2 | vulnerable |
| Debian | openvpn3-client | 14 | 25+dfsg-3 | vulnerable |
| Debian | openvpn3-client | 14 | 25+dfsg-4 | vulnerable |
| Debian | openvpn3-client | 14 | 26+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 14 | 26+dfsg-2 | vulnerable |
| Debian | openvpn3-client | 14 | 27+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 14 | 27.1+dfsg-1 | vulnerable |
| Debian | openvpn3-client | 14 | 27.1+dfsg-2 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.3-4ubuntu1 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.4-1ubuntu1 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.4-2ubuntu1 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.4-2ubuntu1.1 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.4-2ubuntu1.2 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.4-2ubuntu1.3 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.4-2ubuntu1.5 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.4-2ubuntu1.6 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.4-2ubuntu1.7 | vulnerable |
| Ubuntu | openvpn | pro | 2.4.4-2ubuntu1.7+esm1 | vulnerable |
| Ubuntu | openvpn | 20.04 | 2.4.7-1ubuntu2 | vulnerable |
| Ubuntu | openvpn | 20.04 | 2.4.7-1ubuntu2.20.04.2 | vulnerable |
| Ubuntu | openvpn | 20.04 | 2.4.7-1ubuntu2.20.04.3 | vulnerable |
| Ubuntu | openvpn | 20.04 | 2.4.7-1ubuntu2.20.04.4 | vulnerable |
| Ubuntu | openvpn | 20.04 | 2.4.12-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | openvpn | 20.04 | 2.4.12-0ubuntu0.20.04.2 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.1-3ubuntu1 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.1-3ubuntu2 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.1-3ubuntu4 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.1-3ubuntu5 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.5-1ubuntu1 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.5-1ubuntu3 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.5-1ubuntu3.1 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.9-0ubuntu0.22.04.2 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.9-0ubuntu0.22.04.3 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.11-0ubuntu0.22.04.1 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.11-0ubuntu0.22.04.3 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.11-0ubuntu0.22.04.4 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.11-0ubuntu0.22.04.5 | vulnerable |
| Ubuntu | openvpn | 22.04 | 2.5.11-0ubuntu0.22.04.6 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.5-0ubuntu1 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.7-1ubuntu1 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.9-1ubuntu2 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.9-1ubuntu3 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.9-1ubuntu4 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.9-1ubuntu4.1 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.12-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.12-0ubuntu0.24.04.3 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.14-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.14-0ubuntu0.24.04.2 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.14-0ubuntu0.24.04.3 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.19-0ubuntu0.24.04.1 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.19-0ubuntu0.24.04.2 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.19-0ubuntu0.24.04.3 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.19-0ubuntu0.24.04.4 | vulnerable |
| Ubuntu | openvpn | 24.04 | 2.6.19-0ubuntu0.24.04.5 | vulnerable |
| Ubuntu | openvpn | 26.10 | 2.7.0-1ubuntu1 | vulnerable |
| Ubuntu | openvpn | 26.10 | 2.7.3-1ubuntu2 | vulnerable |
| Ubuntu | openvpn | 26.10 | 2.7.5-1ubuntu2 | vulnerable |
| Ubuntu | openvpn | 26.10 | 2.7.5-1ubuntu3 | vulnerable |
| Ubuntu | openvpn | 26.10 | 2.7.7-1ubuntu1 | vulnerable |
| Ubuntu | openvpn | 26.10 | 2.7.7-1ubuntu1.1 | vulnerable |
| Ubuntu | openvpn | 26.04 | 2.6.14-2ubuntu1 | vulnerable |
| Ubuntu | openvpn | 26.04 | 2.6.15-1ubuntu1 | vulnerable |
| Ubuntu | openvpn | 26.04 | 2.7.0~rc5-1ubuntu5 | vulnerable |
| Ubuntu | openvpn | 26.04 | 2.7.0~rc6-1ubuntu1 | vulnerable |
| Ubuntu | openvpn | 26.04 | 2.7.0-1ubuntu1 | vulnerable |
| Ubuntu | openvpn | 26.04 | 2.7.0-1ubuntu1.1 | vulnerable |
| Ubuntu | openvpn | 26.04 | 2.7.0-1ubuntu1.2 | vulnerable |
| Ubuntu | openvpn | 26.04 | 2.7.0-1ubuntu1.3 | vulnerable |
| Ubuntu | openvpn | 26.04 | 2.7.0-1ubuntu1.4 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [openvpn3-client]Affected
Details (2)
24.1+dfsg-1· amd64 · trixieAffected
pypi · openvpn3-client · debian · 13
24.1+dfsg-1· arm64 · trixieAffected
pypi · openvpn3-client · debian · 13
Observed: