Is CVE-2025-3110 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-3110 being exploited in the wild.

How severe is CVE-2025-3110?

Informational severity, with a CVSS score of 6.9, published 8 July 2026.

Which products and versions are affected?

Openvpn Access Server 2.7.2 through 3.1.0.

Is there a fix for CVE-2025-3110?

A patch was published on 2026-04-28: Access Server 3.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-3110 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-3110?

Check whether you run Openvpn Access Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-3110: OpenVPN Access Server HTTP request smuggling via bare line-feed sequences

CVE-2025-3110 · Severity: info · CVSS 6.9 · Published 2026-07-08

OpenVPN Access Server is a solution used by businesses to provide secure remote access to their internal networks. A vulnerability in how the server handles web traffic allows attackers to "smuggle" hidden requests past security filters when the server is used behind a reverse proxy. This could allow an attacker to bypass security controls or gain unauthorized access to internal web resources.

Vendors: Openvpn.

Quick answers

Is CVE-2025-3110 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-3110 being exploited in the wild.
How severe is CVE-2025-3110?: Informational severity, with a CVSS score of 6.9, published 8 July 2026.
Which products and versions are affected?: Openvpn Access Server 2.7.2 through 3.1.0.
Is there a fix for CVE-2025-3110?: A patch was published on 2026-04-28: Access Server 3.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-3110 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-3110?: Check whether you run Openvpn Access Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

OpenVPN Access Server versions 2.7.2 through 3.1.0 are vulnerable to HTTP Request Smuggling (CWE-444). The software incorrectly handles bare line-feed (LF) characters within HTTP header values instead of requiring the standard CRLF sequence. When the Access Server is deployed behind a reverse proxy that interprets these sequences differently, an attacker can craft a request that is seen as one request by the proxy but two separate requests by the backend Access Server. This allows the attacker to 'smuggle' a second, unauthorized request to the backend, potentially bypassing security constraints enforced by the proxy. The issue is addressed in Access Server version 3.2.0.

Affected products

OpenVPN Access Server 2.7.2 through 3.1.0

Timeline

2026-04-28: patched: Access Server 3.2.0 released
2026-07-08: advisory: CVE-2025-3110 published

References

https://openvpn.net/as-docs/as-3-2-release-notes.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.