CVE-2026-13698

OpenVPN versions 2.5.0 to 2.5.11, 2.6.0 to 2.6.20, and 2.7_alpha1 to 2.7.4 are vulnerable to a memory leak that can be exploited by remote attackers possessing a valid tls-crypt-v2 client key, potentially leading to a denial of service. Organizations using these versions should prioritize patching to mitigate the risk of service disruption. This vulnerability poses a significant threat to any environment relying on OpenVPN for secure communications.