Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-63650

Fixed in a distro release EPSS <1%CVSS 2.0

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field

Published 2026-08-14 · CVE record · OSV

Products: OpenVPN

Distro releases

ReleasePackageFixed in
Debian 12openvpnno fix
Debian 13openvpnno fix
Debian 14openvpnno fix
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSopenvpn2.5.6-150400.3.28.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSopenvpn2.5.6-150400.3.28.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSopenvpn2.5.6-150400.3.28.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSopenvpn2.5.6-150400.3.28.1
SUSE Linux Enterprise Module for Basesystem 15 SP7openvpn2.6.10-150600.3.37.1
SUSE Linux Enterprise Module for Basesystem 15 SP7openvpn-dco2.6.10-150600.3.37.1
SUSE Linux Enterprise Server 15 SP4-LTSSopenvpn2.5.6-150400.3.28.1
SUSE Linux Enterprise Server 15 SP5-LTSSopenvpn2.5.6-150400.3.28.1
SUSE Linux Enterprise Server 15 SP6-LTSSopenvpn2.6.10-150600.3.37.1
SUSE Linux Enterprise Server 15 SP6-LTSSopenvpn-dco2.6.10-150600.3.37.1
SUSE Linux Enterprise Server 16.0openvpn2.6.10-160000.5.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4openvpn2.5.6-150400.3.28.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5openvpn2.5.6-150400.3.28.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6openvpn2.6.10-150600.3.37.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6openvpn-dco2.6.10-150600.3.37.1
SUSE Linux Enterprise Server for SAP applications 16.0openvpn2.6.10-160000.5.1
Ubuntu 20.04 LTSopenvpnno fix
Ubuntu 22.04 LTSopenvpnno fix
Ubuntu 24.04 LTSopenvpnno fix
Ubuntu 26.04 LTSopenvpnno fix
Ubuntu Pro 14.04 LTSopenvpnno fix
Ubuntu Pro 16.04 LTSopenvpnno fix
Ubuntu Pro 18.04 LTSopenvpnno fix
openSUSE Leap 16.0openvpn2.6.10-160000.5.1