# CVE-2025-3110: OpenVPN Access Server HTTP request smuggling via bare line-feed sequences

Source: https://junglewise.ai/threats/cve-2025-3110-openvpn-access-server-http-request-smuggling-via-bare-line-feed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2025-3110 · Severity: info · CVSS 6.9 · Published 2026-07-08

OpenVPN Access Server is a solution used by businesses to provide secure remote access to their internal networks. A vulnerability in how the server handles web traffic allows attackers to "smuggle" hidden requests past security filters when the server is used behind a reverse proxy. This could allow an attacker to bypass security controls or gain unauthorized access to internal web resources.

Vendors: [Openvpn](https://junglewise.ai/threats/vendors/openvpn).

## Quick answers

**Is CVE-2025-3110 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-3110 being exploited in the wild.

**How severe is CVE-2025-3110?** Informational severity, with a CVSS score of 6.9, published 8 July 2026.

**Which products and versions are affected?** Openvpn Access Server 2.7.2 through 3.1.0.

**Is there a fix for CVE-2025-3110?** A patch was published on 2026-04-28: Access Server 3.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-3110 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-3110?** Check whether you run Openvpn Access Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

OpenVPN Access Server versions 2.7.2 through 3.1.0 are vulnerable to HTTP Request Smuggling (CWE-444). The software incorrectly handles bare line-feed (LF) characters within HTTP header values instead of requiring the standard CRLF sequence. When the Access Server is deployed behind a reverse proxy that interprets these sequences differently, an attacker can craft a request that is seen as one request by the proxy but two separate requests by the backend Access Server. This allows the attacker to 'smuggle' a second, unauthorized request to the backend, potentially bypassing security constraints enforced by the proxy. The issue is addressed in Access Server version 3.2.0.

## Affected products

- OpenVPN Access Server 2.7.2 through 3.1.0

## Timeline

- 2026-04-28: patched: Access Server 3.2.0 released
- 2026-07-08: advisory: CVE-2025-3110 published

## References

- [https://openvpn.net/as-docs/as-3-2-release-notes.html](https://openvpn.net/as-docs/as-3-2-release-notes.html)