OpenVPN 2.7.7 is now available as a security-focused update to the widely used open-source VPN solution, addressing seven CVE-tracked vulnerabilities plus additional hardening, networking, and reliability fixes.
Among the platform-independent fixes is CVE-2026-84732, which addresses two problems in OpenVPN’s reliability layer. On Windows, OpenVPN 2.7.7 fixes CVE-2026-84256, an issue involving incorrect CreateProcess() command-line quoting for characters treated specially by cmd.exe.
Another Windows vulnerability, CVE-2026-84226, concerns the tapctl utility. CVE-2026-82312 fixes the use of NULL DACLs for several system objects. The release also resolves CVE-2026-78221 in openvpnserv, where UTF-8 encoded internationalized domain names could result in an incorrect NRPT domain size being passed and potentially trigger a buffer overread.
Another openvpnserv issue, CVE-2026-78043, allowed a forward slash in configuration paths. Plus, CVE-2026-81738 fixes an off-by-one error in the temporary buffer guard used by write_dhcp_search_str().
For Linux users, the client now validates Netlink replies against the request that generated them, providing an additional safeguard when communicating with the Linux kernel through Netlink.
One notable user-visible change is also included. When using the EPOCH data-channel format, OpenVPN now keeps four future keys instead of 16.
Finally, OpenVPN no longer adjusts a UDP checksum when its value is zero, following RFC 768. Its OpenSSL integration avoids resetting the HMAC key for every packet. This should eliminate unnecessary work in the packet-processing path.
For additional details, see the changelog.
