Skip to content
Fencer Intel
high 7.5

CVE-2017-7478 in the critical feed json

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet.

published 2017-05-15 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16499

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
13.8%
EPSS 13.8% chance of exploitation in 30 days, percentile 96%
public exploits
1
Exploit-DB

Summary

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. Note that this issue is fixed in 2.3.15 and 2.4.2.

Patch / fix

  • openvpn Debian 14, Debian 13, Debian 12 2.4.0-5

debian advisories DEBIAN-CVE-2017-7478

  • openvpn SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +2 more 2.0.9-143.47.3.1
  • openvpn-openssl1 SLES 11-SECURITY 2.3.2-0.9.1
  • openvpn SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 +1 more 2.3.8-16.14.1

suse advisories SUSE-SU-2017:2838-1SUSE-SU-2017:1718-1SUSE-SU-2017:1622-1

  • openvpn Alpine 3.5 2.3.15-r0
  • openvpn Alpine 3.6 2.4.2-r0

alpine advisories ALPINE-CVE-2017-7478

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openvpn Arch Linux 2.4.2-1

arch linux advisories AVG-271

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-7478 updated cvss 7.5

openvpn: Unauthenticated DoS via large control packets

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-41993)
  2. Published

Exploit prediction

13.78% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-41993 OpenVPN 2.4.0 - Denial of Service dos, 2017-05-11

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • OpenVPN Technologies, Inc openvpn

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.