OpenVPN Denial-of-Service Vulnerability via Improper Packet Length Validation in tls-crypt-v2 Key Extraction

A denial-of-service vulnerability has been identified in OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1. The issue arises from improper validation of packet length during the tls-crypt-v2 key extraction process, allowing authenticated attackers to trigger a fatal assertion and cause a crash by sending a specially crafted packet.

Impact

Exploitation of this vulnerability leads to a fatal assertion failure, causing a crash and denial-of-service condition on the affected system.