← Database

CVE-2024-5594

CRITICAL CVSS: 9.1 Published: 2025-01-06 Modified: 2026-06-17

Description

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

Affected Platforms

Openvpn Openvpn

Weakness Type

CWE-1287

References