# CVE-2026-13698: OpenVPN memory leak in tls-crypt-v2 handling

Source: https://junglewise.ai/threats/cve-2026-13698-openvpn-memory-leak-in-tls-crypt-v2-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-06. Updated: 2026-07-06  
License: CC BY 4.0 with a link back

CVE-2026-13698 · Severity: info · CVSS 6 · Published 2026-07-06

A memory leak vulnerability has been identified in OpenVPN, a widely used software for creating secure point-to-point or site-to-site connections. An attacker with a valid client key can repeatedly trigger this leak to exhaust the server's available memory. This can lead to a denial-of-service condition, causing the VPN service to crash or become unresponsive for all users.

## Quick answers

**Is CVE-2026-13698 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13698 being exploited in the wild.

**How severe is CVE-2026-13698?** Informational severity, with a CVSS score of 6, published 6 July 2026.

**Which products and versions are affected?** OpenVPN Inc. OpenVPN 2.5.0 through 2.5.11, 2.6.0 through 2.6.20, 2.7_alpha1 through 2.7.4.

**Is there a fix for CVE-2026-13698?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-13698 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-13698?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A memory leak exists in OpenVPN (versions 2.5.0-2.5.11, 2.6.0-2.6.20, and 2.7_alpha1-2.7.4) due to the missing release of memory after its effective lifetime (CWE-401). The vulnerability is triggered during the handling of tls-crypt-v2 client keys. A remote attacker possessing a valid tls-crypt-v2 key can exploit this by initiating multiple connections or requests that allocate memory without subsequent deallocation. Over time, this results in resource exhaustion (CWE-770), leading to a denial-of-service (DoS) against the OpenVPN server. While the attack requires a valid key, it can be executed over the network.

## Affected products

- OpenVPN Inc. OpenVPN 2.5.0 through 2.5.11, 2.6.0 through 2.6.20, 2.7_alpha1 through 2.7.4

## Timeline

- 2026-07-06: disclosed: Initial disclosure of CVE-2026-13698
- 2026-07-06: advisory: NVD record published

## References

- [https://community.openvpn.net/Security%20Announcements/CVE-2026-13698](https://community.openvpn.net/Security%20Announcements/CVE-2026-13698)