Updated openvpn packages fix security vulnerabilities
Publication date: 10 May 2026Modification date: 10 May 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-35058 , CVE-2026-40215
Description
CVE-2026-35058 - fix server ASSERT() on receiving a suitably malformed
packet with a valid tls-crypt-v2 key
CVE-2026-40215 - fix race condition in TLS handshake that could lead to
leaking of packet data from a previous handshake under specific
circumstances
References
- https://bugs.mageia.org/show_bug.cgi?id=35442
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SFR4RR6F447AZK2ZTKVGZP3NKKWFW6DW/
- https://community.openvpn.net/Security%20Announcements/CVE-2026-35058
- https://community.openvpn.net/Security%20Announcements/CVE-2026-40215
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35058
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40215
SRPMS
9/core
- openvpn-2.6.20-1.1.mga9