CVE-2023-46849

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-11 · updated 2026-06-17
Weakness: CWE-369

Description

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.

Affected products

Debian Linux: 12.0
Fedoraproject Fedora: 39
OpenVPN: from 2.6.0 through 2.6.6
OpenVPN Access Server: from 2.11.0 through 2.11.3; 2.12.0, 2.12.1

References

https://community.openvpn.net/openvpn/wiki/CVE-2023-46849
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/
https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/
https://www.debian.org/security/2023/dsa-5555
https://community.openvpn.net/openvpn/wiki/CVE-2023-46849
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/
https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/
https://www.debian.org/security/2023/dsa-5555

Get alerted when CVE-2023-46849 or the next vulnerability affects your stack