Medium5.3Red Hat Linux

Medium [CVE-2026-13122] From CVEorg collector

This medium-severity Red Hat Linux advisory covers CVE-2026-13122.

CVE-2026-13122 Published Jul 6, 2026Updated by vendor Jul 6, 2026

CVE-2026-13122

Affected products & platforms

Red Hat LinuxUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled A flaw was found in OpenVPN. A remote attacker can exploit this vulnerability by sending a malformed authentication token.

This can trigger a reachable assertion when external authentication (external-auth) is enabled, leading to a Denial of Service (DoS) condition for the OpenVPN server. This issue specifically impacts deployments where external authentication is enabled, increasing the attack surface.

Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617.

Affected versions

2.6.0
2.6.20
2.7.4

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

To reduce exposure, disable the `external-auth` feature in OpenVPN if it is not required. This can be done by removing or commenting out the `external-auth` directive in the OpenVPN configuration file. If `external-auth` is necessary, restrict network access to the OpenVPN service to trusted clients through firewall rules. A restart of the OpenVPN service is required for configuration changes to take effect, which may temporarily disrupt active connections.

Official advisory · high-confidence parse· fetched 11 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.