Executive brief
OpenVPN Access Server is a solution used by businesses to provide secure remote access to their internal networks. A vulnerability in how the server handles web traffic allows attackers to "smuggle" hidden requests past security filters when the server is used behind a reverse proxy. This could allow an attacker to bypass security controls or gain unauthorized access to internal web resources.
Technical details
OpenVPN Access Server versions 2.7.2 through 3.1.0 are vulnerable to HTTP Request Smuggling (CWE-444). The software incorrectly handles bare line-feed (LF) characters within HTTP header values instead of requiring the standard CRLF sequence. When the Access Server is deployed behind a reverse proxy that interprets these sequences differently, an attacker can craft a request that is seen as one request by the proxy but two separate requests by the backend Access Server. This allows the attacker to 'smuggle' a second, unauthorized request to the backend, potentially bypassing security constraints enforced by the proxy. The issue is addressed in Access Server version 3.2.0.
Affected products
- OpenVPN Access Server 2.7.2 through 3.1.0
Timeline
- 2026-04-28: patched: Access Server 3.2.0 released
- 2026-07-08: advisory: CVE-2025-3110 published