Version 2.7.8-I001 du 08/10/2026- Security fixed : Check for NULL-Bytes in certificate subjects - refuse all such certificates now as "invalid".
- Security fixed : TLS handshake with tls-crypt-v2: do not try to add a wrapped client key if no key material is available (client bug in response to an ill-behaving server).
- Security fixed : (No CVE assigned as "a malicious server can stop the client from working properly" is not considered a CVE-worthy security issue according to the CRA guidelines)
- Security fixed : options: fix unsigned underflow when clearing domain_search_list.
- Security fixed : win32: stop cmd.exe from expanding variables in quoted arguments.
- User-visible Changes : Certificate validation is now stricter regarding NULL bytes in strings (see above). This might break existing installations if such certificates exist and OpenSSL builds are used. mbedTLS builds always rejected this.
- User-visible Changes : On a certificate with duplicate fields (multiple CN, for example) OpenSSL builds would use the last one, mbedTLS builds use the first one - changed in the mbedTLS build so behaviour is identical.
- Fixed : DCO: remove installed iroutes at client exit time, not at delayed multi instance cleanup time - otherwise there is a race with reconnecting clients, possibly ending up having "no iroutes installed in the system at all". Bug reported by OpenVPN Inc Access Server team.
- Fixed : DCO Linux: fix remaining races between synchronous netlink operations and incoming asynchronous notifications, by adding a second netlink socket and strictly separating sync/async operations.
- Fixed : Client: refuse incoming pushed option combination of epoch data format with non-AEAD ciphers (restart session instead of aborting with a fatal error).
- Fixed : DCO (Linux and Windows): on failures to set up a new peer or install key materials for a peer, do not exit OpenVPN with a fatal error. Instead, signal the error up the call-chain and restart the (multi) instance.
- Fixed : The handshake is inherently racy when a peer is removed kernel-side due to transport errors or timeouts, and userland does not yet know this and wants to, for example, install new keys. This is fatal for the particular client instance, but must not end the whole server process.
- Fixed : DCO: stop fetching peer stats during client disconnect The intention of the original code was to ensure reported counters are always correct, but it did not work (because at query time, the peer in kernel is already gone, so we only got an error message) - and very inefficiently so (because we queried all the peers all the time). End-of-session final counter values will be implemented properly by a followup patch leveraging counters piggybacked on the kernel's "DEL_PEER" notification message.
- Fixed : p2mp server: improve handling of mbuf lists in the face of broadcast or multicast traffic, and fix a bug on client exit that could lead to a server queue deadlock in very particular scenarios.
(0 votes)
