OpenVPN 2.7.9 has been released as the latest update to the open-source VPN software. The release fixes CVE-2026-121720, a Windows-specific vulnerability involving insufficient filtering of user-defined environment variables passed by the OpenVPN service to the main executable. The service now applies stricter validation to prevent unsafe values from being passed along.
The second vulnerability, CVE-2026-115342, concerns command-line parsing in the Windows service. OpenVPN now performs more robust validation of improperly quoted arguments and uses the same Windows CommandLineToArgvW() function for command-line parsing in both the main executable and the interactive service.
Additional Windows security improvements restrict plugin DLL dependencies to trusted plugin, application, and system directories. Moreover, OpenVPN processes started through the interactive service now run at a high integrity level, protecting their process memory and threads against tampering.
For Linux users, OpenVPN 2.7.9 introduces support for the IFF_BACKPRESSURE flag where available. This allows the kernel’s TUN/TAP subsystem to apply packet prioritization through mechanisms like queuing disciplines when userspace cannot process incoming traffic quickly enough. Previously, the kernel simply dropped packets under these conditions.
Authentication also gets a fix for incorrectly parsing excessively long usernames in --auth-user-pass files or inline configurations. Previously, part of an oversized username could end up in the password field.
On the UI side, the management interface can now provide an existing username when requesting a password, allowing compatible VPN clients to prefill the username field or request only the missing password. The functionality requires management interface compatibility level 6 or higher.
Other fixes address memory leaks in the Windows service, incorrect handling of DHCP-provided IPv6 DNS servers, and missing gateway information in routing output. The release also corrects access checks for --extra-certs files and resolves several potential crashes and resource leaks.
Cryptographic handling has been tightened as well. OpenVPN now more consistently clears sensitive key material from memory, including authentication token secrets and PEM-decoded keys. Additional changes improve certificate revocation list handling and prevent port-sharing journal files from being written through symbolic or hard links.
Finally, OpenVPN 2.7.9 includes compatibility adjustments for OpenSSL 4.1, along with a Linux networking maintenance change that uses RTM_SETLINK instead of RTM_NEWLINK when updating existing interfaces.
For more information, see the changelog.
