# OpenVPN changelog > A robust and flexible VPN daemon. - Vendor: OpenVPN - Category: Developer Tools - Official site: https://openvpn.net - Tracked by: What's New (https://whatsnew.fyi/product/openvpn) - Harvested from: GitHub (OpenVPN/openvpn) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. ## Releases ### v2.6.22 - Date: 2026-08-06 - Version: v2.6.22 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.6.22 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.6.22 - **security** — Improve command line validation in openvpnserv on Windows to prevent circumventing admin restrictions on allowed OpenVPN config directories - **security** — Make DCO key state desynchronization recoverable and improve the state machine robustness - **fixed** — Refuse incoming HARD RESET packets with a sequence ID not equal to 0 to prevent TLS handshake establishment failures in peer-to-peer TLS setups - **fixed** — Correct minimum packet length check for 802.1q tagged packets ###### Security fixes: - openvpnserv (windows): better scrutinize command line passed in from the control socket to openvpn. This would lead to circumventing admin restrictions on allowed openvpn config directories (but never to "read files the user has no permissions for") ([CVE-2026-63649](https://www.cve.org/CVERecord?id=CVE-2026-63649)) Bug found by 章鱼哥 (www.aipyaipy.com) - dco: make key state desync recoverable This was reported as a "with suitable timing, a key-update de-sync between OpenVPN and the kernel could trigger an ASSERT()", and was initially handled as security report. It turned out to be not exploitable, but the state machine was not very robust and so the opportunity was used to improve the code. Bug found by 章鱼哥 (www.aipyaipy.com) ###### Bugfixes: - refuse incoming HARD RESET packets with a sequence ID != 0 (this is basically making an OpenVPN server ignore and log a "should never happen" client-side misbehaviour, which could lead to TLS handshake establishment failures in p2p TLS setups) - correct minimum packet length check for 802.1q tagged packets (Github: [OpenVPN/openvpn#1044](https://github.com/OpenVPN/openvpn/issues/1044)). This was also reported (twice) as a security bug, as technically OpenVPN with `--client-nat` would read and write up to 4 bytes "after the end of the packet" - but due to the OpenVPN packet buffer layouts, which are always full-frame-sized this is fully safe and has no adverse consequences. **Full Changelog**: https://github.com/OpenVPN/openvpn/compare/v2.6.21...v2.6.22 ### v2.7.6 - Date: 2026-08-06 - Version: v2.7.6 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.6 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.7.6 - **security** — Better scrutinize command line passed from the control socket to openvpn on Windows to prevent circumventing admin restrictions on allowed OpenVPN config directories - **security** — Make key state desync recoverable in DCO to improve the robustness of the state machine - **security** — Make --x509-username-field work correctly with mbedTLS to prevent unintentionally permitting certificates that should be rejected - **changed** — Default to --dev tun if --dev is not specified, allowing this option to be omitted from OpenVPN config for the tun case - **changed** — Limit --ping and --keepalive settings to a maximum of 24 hours to avoid overflow issues with 32 bit integers in the DCO kernel - **changed** — Enable TCP_NODELAY socket flag to always be on, while keeping the --tcp-nodelay option for p2mp server configurations that push socket flags to clients - **changed** — Remove --providers from --help output on mbedTLS builds - **fixed** — Refuse incoming HARD RESET packets with a sequence ID other than 0 to prevent TLS handshake establishment failures in p2p TLS setups - **fixed** — Correctly calculate packet id size when epoch packet format is in use, fixing a 4-byte offset error that exceeded mssfix mtu headroom for OpenVPN 2.7+ to 2.7+ connections - **fixed** — Correct minimum packet length check for 802.1q tagged packets ###### Security fixes: - openvpnserv (windows): better scrutinize command line passed in from the control socket to openvpn. This would lead to circumventing admin restrictions on allowed openvpn config directories (but never to "read files the user has no permissions for") ([CVE-2026-63649](https://www.cve.org/CVERecord?id=CVE-2026-63649)) Bug found by 章鱼哥 (www.aipyaipy.com) - dco: make key state desync recoverable This was reported as a "with suitable timing, a key-update de-sync between OpenVPN and the kernel could trigger an ASSERT()", and was initially handled as security report. It turned out to be not exploitable, but the state machine was not very robust and so the opportunity was used to improve the code. Bug found by 章鱼哥 (www.aipyaipy.com) - make ``--x509-username-field`` work with mbedTLS. In very particular setups, together with a CA creating matching certificates, this could lead to unintentionally permitting a certificate that should not have. This is why this was considered a (low-prio) security bug and a CVE ID was assigned ([CVE-2026-63650](https://www.cve.org/CVERecord?id=CVE-2026-63650)) Bug found by 章鱼哥 (www.aipyaipy.com) User-visible Changes: - if `--dev` is not specified, default to `--dev tun` - so for the tun case, this option can now be left out of the openvpn config. - `--ping` and `--keepalive` settings are now limited to 24 hours maximum - the primary reason for that is to avoid lots of extra code in the DCO kernel to handle arbitrarily large values without overflowing 32 bit integers. 24h is considered much higher than any reasonable use. - The `TCP_NODELAY` socket flag is now "always on". The `--tcp-nodelay` option is kept, because setting it on a p2mp server also enables pushing of `socket-flags TCP_NODELAY` to clients, which might not have this code change yet. - Remove `--providers` from `--help` output on mbedTLS builds. ###### Bugfixes: - refuse incoming HARD RESET packets with a sequence ID != 0 (this is basically making an OpenVPN server ignore and log a "should never happen" client-side misbehaviour, which could lead to TLS handshake establishment failures in p2p TLS setups) - correctly calculate packet id size if epoch packet format is in use - this was off by 4, for connections openvpn 2.7+ to openvpn 2.7+, exceeding "mssfix mtu" headroom by those 4 bytes (Github: [OpenVPN/openvpn#1074](https://github.com/OpenVPN/openvpn/issues/1074)) - correct minimum packet length check for 802.1q tagged packets (Github: [OpenVPN/openvpn#1044](https://github.com/OpenVPN/openvpn/issues/1044)). This was also reported (twice) as a security bug, as technically OpenVPN with `--client-nat` would read and write up to 4 bytes "after the end of the packet" - but due to the OpenVPN packet buffer layouts, which are always full-frame-sized this is fully safe and has no adverse consequences. **Full Changelog**: https://github.com/OpenVPN/openvpn/compare/v2.7.5...v2.7.6 ### v2.7.5 - Date: 2026-07-02 - Version: v2.7.5 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.5 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.7.5 - **security** — Fix DNS SearchList state pollution on Windows openvpnserv that could corrupt pre-OpenVPN DNS config with specific combinations of --dns config entries plus local DNS config (CVE-2026-13379) - **security** — Fix use-after-free bug in ack_write_buf() triggerable by a well-timed sequence of control channel and authentication packets (CVE-2026-12996) - **security** — Fix use-after-free bug in tls_wrap_reneg() triggerable by suitable sequence of dynamic tls-crypt control-channel packets (CVE-2026-13117) - **security** — Fix server crash on reception of suitably malformed auth-token when --auth-gen-token external-auth is active (CVE-2026-13122) - **security** — Fix memory leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and server crashes (CVE-2026-12932) - **security** — Fix possible 1-byte buffer overrun on NTLMv2 proxy responses (CVE-2026-11771) - **security** — Fix memory leak on reception of suitable tls-crypt-v2 packets that could lead to out-of-memory situation and server crash (CVE-2026-13698) - **fixed** — Fix Windows plugin trusted-dir check prefix bypass in path checking logic - **fixed** — Fix buffer overread in Windows openvpnserv ConvertItfDnsDomains - **fixed** — Fix use-after-free of DNS options on client connect with suitable --dns or --dhcp-option DNS options in server config - **fixed** — Fix memory leak in dns_server_addr_parse when too many server addresses are configured - **fixed** — Improve multi-socket event handling to prevent inefficient processing with multiple open UDP sockets with concurrent traffic - **fixed** — Null-terminate tls-crypt client keys when testing - **fixed** — Fix mudp HMAC reset reply to send synchronously instead of via queue to prevent replies being sent to wrong client IP or socket - **fixed** — Fix port-share and multi-socket interaction where port-share TCP listener check was incorrect - **fixed** — Ensure pushed tun-mtu is no lower than TUN_MTU_MIN to prevent client ASSERT() - **fixed** — Assert buffer length before reading prepended sockaddr family on Windows socket to prevent potential overread from DCO driver misbehaviour - **changed** — Improve documentation for --float - **added** — Add documentation for --preresolve - **changed** — Improve documentation around DNS config ###### Security fixes: - openvpnserv (windows): fix DNS SearchList state pollution on (dis)connect. specific combinations of `--dns` config entries plus local DNS config could lead to corruption of pre-openvpn DNS config ([CVE-2026-13379](https://www.cve.org/CVERecord?id=CVE-2026-13379)) Bug found by 章鱼哥 (www.aipyaipy.com). - Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets ([CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996)) Bug found by multiple researchers: - 章鱼哥 (www.aipyaipy.com) - Haiyang Huang - Haruki Oyama (Waseda University) - Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable sequence of dynamic tls-crypt control-channel packets ([CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117)) Bug found by multiple researchers: - Trace37 Labs (github.com/trace37labs) - Haiyang Huang - Fix server crash on reception of suitably malformed auth-token, if `--auth-gen-token external-auth` is active ([CVE-2026-13122](https://www.cve.org/CVERecord?id=CVE-2026-13122)) Bug found by Haiyang Huang. - Fix memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes ([CVE-2026-12932](https://www.cve.org/CVERecord?id=CVE-2026-12932)) Bug found by Valton Tahiri. - Fix possible 1-byte buffer overrun on NTLMv2 proxy responses. ([CVE-2026-11771](https://www.cve.org/CVERecord?id=CVE-2026-11771)) Bug found by Tristan Madani (@TristanInSec). - Fix another memory leak on reception of suitable tls-crypt-v2 packets that could lead to an out of memory situation and server crash ([CVE-2026-13698](https://www.cve.org/CVERecord?id=CVE-2026-13698)) Bug found by Max Fillinger. Overlaps with a report from Valton Tahiri that we believe to be fixed by this bugfix as well. ###### Bugfixes: - Windows: fix plugin trusted-dir check prefix bypass (this fixes a bug in the path checking logic we do on Windows for "is loading a plugin from this path allowed?", but since we could not find a way to exploit this unless starting with admin privs or a social engineering attack, not classified as a security fix) - Windows: openvpnserv: rework ConvertItfDnsDomains and tests (this fixes a buffer overread that is not exploitable and as such not classified as security fix) - options: fix use-after-free of DNS options on client connect (using suitable `--dns` or `--dhcp-option DNS` options in a server config - not pushed, but applying to the server itself - triggers a double free() and use-after-free condition, possibly crashing the server) (Github: [OpenVPN/openvpn#1060](https://github.com/OpenVPN/openvpn/issues/1060)) - dns: Fix memory leak in dns_server_addr_parse, if too many server addresses are configured (Github: [OpenVPN/openvpn#1055](https://github.com/OpenVPN/openvpn/issues/1055)) - improve multi-socket event handling further - multiple open UDP sockets with concurrent traffic could lead to inefficient processing, and the old code was also very hard to follow. (This was initially triggered by a report from Joshua Rogers using ZeroPath, but turned out to be "just bad code" not a security vulnerability) - Null-terminate tls-crypt client keys when testing - non-exploitable strlen() on a buffer that is not null-terminated - mudp: send HMAC reset reply synchronously this fixes a bug where multiple incoming tls-crypt-v2 RESET packets on different sockets could end up overwriting each other's control structures, leading to initial handshake packets (HMAC reset reply) being sent to the wrong client IP, or on a non-suitable socket ("v4 packet on a v6 socket"). Since the overall flow here is stateless by nature, do not artificially create state by creating elaborate queues, just s _[Truncated at 4000 characters — full notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.5]_ ### v2.6.21 - Date: 2026-07-02 - Version: v2.6.21 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.6.21 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.6.21 - **security** — Fix use-after-free bug in ack_write_buf() triggerable by a well-timed sequence of control channel and authentication packets - **security** — Fix use-after-free bug in tls_wrap_reneg() triggerable by suitable sequence of dynamic tls-crypt control-channel packets - **security** — Fix server crash on reception of suitably malformed auth-token when --auth-gen-token external-auth is active - **security** — Fix memory leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes - **security** — Fix possible 1-byte buffer overrun on NTLMv2 proxy responses - **security** — Fix memory leak on reception of suitable tls-crypt-v2 packets that could lead to out of memory situation and server crash - **fixed** — Windows: fix plugin trusted-dir check prefix bypass - **fixed** — Fix use-after-free of DNS options on client connect using suitable --dns or --dhcp-option DNS options in a server config - **fixed** — Null-terminate tls-crypt client keys when testing - **fixed** — Ensure pushed tun-mtu is no lower than TUN_MTU_MIN to prevent client ASSERT() ###### Security fixes: - Fix use-after-free bug in ack_write_buf(), triggerable by a well-timed sequence of control channel + authentication packets ([CVE-2026-12996](https://www.cve.org/CVERecord?id=CVE-2026-12996)) Bug found by multiple researchers: - 章鱼哥 (www.aipyaipy.com) - Haiyang Huang - Haruki Oyama (Waseda University) - Fix use-after-free bug in tls_wrap_reneg(), triggerable by suitable sequence of dynamic tls-crypt control-channel packets ([CVE-2026-13117](https://www.cve.org/CVERecord?id=CVE-2026-13117)) Bug found by multiple researchers: - Trace37 Labs (github.com/trace37labs) - Haiyang Huang - Fix server crash on reception of suitably malformed auth-token, if `--auth-gen-token external-auth` is active ([CVE-2026-13122](https://www.cve.org/CVERecord?id=CVE-2026-13122)) Bug found by Haiyang Huang. - Fix memory-leak in tls-crypt-v2 client key handling that could lead to out-of-memory situations and subsequent server crashes ([CVE-2026-12932](https://www.cve.org/CVERecord?id=CVE-2026-12932)) Bug found by Valton Tahiri. - Fix possible 1-byte buffer overrun on NTLMv2 proxy responses. ([CVE-2026-11771](https://www.cve.org/CVERecord?id=CVE-2026-11771)) Bug found by Tristan Madani (@TristanInSec). - Fix another memory leak on reception of suitable tls-crypt-v2 packets that could lead to an out of memory situation and server crash ([CVE-2026-13698](https://www.cve.org/CVERecord?id=CVE-2026-13698)) Bug found by Max Fillinger. Overlaps with a report from Valton Tahiri that we believe to be fixed by this bugfix as well. ###### Bugfixes: - Windows: fix plugin trusted-dir check prefix bypass (this fixes a bug in the path checking logic we do on Windows for "is loading a plugin from this path allowed?", but since we could not find a way to exploit this unless starting with admin privs or a social engineering attack, not classified as a security fix) - options: fix use-after-free of DNS options on client connect (using suitable `--dns` or `--dhcp-option DNS` options in a server config - not pushed, but applying to the server itself - triggers a double free() and use-after-free condition, possibly crashing the server) (Github: [OpenVPN/openvpn#1060](https://github.com/OpenVPN/openvpn/issues/1060)) - Null-terminate tls-crypt client keys when testing - non-exploitable strlen() on a buffer that is not null-terminated - Ensure pushed tun-mtu is no lower than TUN_MTU_MIN - this fixes a bug where a server can push a suitable combination of options and make the client ASSERT(). (Reported as security issue by Haiyang Huang, but it was decided that the server always has means to make the client "not function properly", and it can not be exploited beyond that) For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.21/Changes.rst) **Windows Client**: Community MSI installer for Windows client can be found at [Community Downloads](https://community.openvpn.net/Downloads). **Linux Packages**: Instructions for installing community-maintained Linux packages can be found in the [Community Wiki](https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos). **Full Changelog**: https://github.com/OpenVPN/openvpn/compare/v2.6.20...v2.6.21 ### v2.7.4 - Date: 2026-04-30 - Version: v2.7.4 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.4 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.7.4 - **fixed** — Fix erroneous enabling of DnsSecValidationRequired on Windows with win-dco when using `--dns server` style configs - **fixed** — Correct comments in `--dns-up-down` platform scripts relating to `dns_server_..._dnssec` values - **fixed** — Fix release-only build of pkcs11-helper vcpkg port to not attempt installing files from debug build - **fixed** — mbedTLS builds now provide a proper error message if a `tls-group` statement with no valid groups is encountered - **removed** — Remove `--enable-strict` and `--enable-strict-options` configure flags ###### Bugfixes: - using `--dns server ...` style configs on Windows with win-dco would lead to erroneously enabling "DnsSecValidationRequired : True", possibly breaking VPN DNS resolution. Pushing `--dns server ... dnssec no` can be used as a workaround until clients can be updated. (Github: [openvpn#1024](https://github.com/OpenVPN/openvpn/issues/1024)) - correct comments in the `--dns-up-down` platform scripts relating to `dns_server_..._dnssec` values. - fix release-only build of pkcs11-helper vcpkg port, do not try to install files from debug build. - mbedTLS builds will now provide a proper error message if a `tls-group` statement with no valid groups is encountered (used to run into SSL handshake failure later on). - `--enable-strict` and `--enable-strict-options` configure flags have been removed (because they did not actually do anything anymore) For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.4/Changes.rst) **Windows Client**: Community MSI installer for Windows client can be found at [Community Downloads](https://openvpn.net/community-downloads/). **Linux Packages**: Instructions for installing community-maintained Linux packages can be found in the [Community Wiki](https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos). **Full Changelog**: https://github.com/OpenVPN/openvpn/compare/v2.7.3...v2.7.4 ### v2.7.3 - Date: 2026-04-27 - Version: v2.7.3 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.3 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.7.3 - **fixed** — Fixed issue where setups using --auth-user-pass file or inline auth-user-pass would no longer use configured passwords and instead prompt on the management interface when combined with --management-query-passwords ###### Bugfixes: * in combination with ``--management-query-passwords``, setups using ``--auth-user-pass file`` or inline ``auth-user-pass`` would no longer use the configured passwords and prompt on the management interface instead (OpenVPN GUI would then provide an empty user/password prompt) (Github: [openpvn#1021](https://github.com/OpenVPN/openvpn/issues/1021)). For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.3/Changes.rst) **Windows Client**: Community MSI installer for Windows client can be found at [Community Downloads](https://openvpn.net/community-downloads/). **Linux Packages**: Instructions for installing community-maintained Linux packages can be found in the [Community Wiki](https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos). **Full Changelog**: https://github.com/OpenVPN/openvpn/compare/v2.7.2...v2.7.3 ### v2.7.2 - Date: 2026-04-22 - Version: v2.7.2 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.2 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.7.2 - **security** — Fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances (CVE-2026-40215) - **security** — Fix server ASSERT() on receiving a suitably malformed packet with a valid tls-crypt-v2 key (CVE-2026-35058) - **added** — Management interface permits input of very long passwords in base64-encoded multiline format - **added** — Signal support to management clients via management version 6 - **changed** — Improve error messages on --verify-x509-name failures - **changed** — Improve error logging when overlong username or passwords cannot be written to TLS buffer - **fixed** — Fix prompting for password from management interface when using a config file with inlined username and no password - **fixed** — Windows: fix DNSSEC flag handling due to bad comparison being always false - **fixed** — Windows: fix deinstallation progress bar on adapter deletion ###### Security fixes: * [CVE-2026-40215](https://www.cve.org/CVERecord?id=CVE-2026-40215): fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances * [CVE-2026-35058](https://www.cve.org/CVERecord?id=CVE-2026-35058): fix server ASSERT() on receiving a suitably malformed packet with a valid tls-crypt-v2 key ###### New features: * management interface: permit input of very long passwords in base64-encoded multiline format. Signal support to management clients via "management version 6". ###### User-visible Changes: * improve error messages on ``--verify-x509-name`` failures * improve error logging when overlong username or passwords can not be written to TLS buffer ###### Bugfixes: * when using a config file with inlined username and no password, fix prompting for the password from management interface. * Windows: fix DNSSEC flag handling - this got never applied due to a bad comparison being always false. * Windows: fix deinstallation progress bar on adapter deletion. For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.2/Changes.rst) **Windows Client**: Community MSI installer for Windows client can be found at [Community Downloads](https://openvpn.net/community-downloads/). **Linux Packages**: Instructions for installing community-maintained Linux packages can be found in the [Community Wiki](https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos). **Full Changelog**: https://github.com/OpenVPN/openvpn/compare/v2.7.1...v2.7.2 ### v2.6.20 - Date: 2026-04-22 - Version: v2.6.20 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.6.20 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.6.20 - **security** — Fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances - **security** — Fix server ASSERT() on receiving a suitably malformed packet with a valid tls-crypt-v2 key - **fixed** — Stop periodic bytecount output on management client disconnection - **fixed** — Make DCO work on FreeBSD systems with no IPv4 support - **fixed** — Fix compilation with --enable-async-push on FreeBSD 15 - **fixed** — Make DCO work on big endian architectures (MIPS, PowerPC) - **fixed** — Fix deinstallation progress bar on adapter deletion on Windows - **fixed** — Fix problem with DCO kernel notifications getting lost, leading to overcounting of number of connected clients and general confusion between kernel and userland regarding peer status on Linux ###### Security fixes: * [CVE-2026-40215](https://www.cve.org/CVERecord?id=CVE-2026-40215): fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances * [CVE-2026-35058](https://www.cve.org/CVERecord?id=CVE-2026-35058): fix server ASSERT() on receiving a suitably malformed packet with a valid tls-crypt-v2 key ###### Bugfixes: * management: stop periodic bytecount output on mgmt client disconnection * FreeBSD: make DCO work on systems with no IPv4 support * FreeBSD: fix compilation with --enable-async-push on FreeBSD 15 * Linux: make DCO work on big endian architectures (MIPS, PowerPC) * Windows: fix deinstallation progress bar on adapter deletion. * Linux: fix problem with DCO kernel notifications getting lost, leading to overcounting of number of connected clients and general confusion between kernel and userland regarding peer status (Github [#900](https://github.com/OpenVPN/openvpn/issues/900), [#918](https://github.com/OpenVPN/openvpn/issues/918), [#931](https://github.com/OpenVPN/openvpn/issues/931), [#919](https://github.com/OpenVPN/openvpn/issues/919), [#945](https://github.com/OpenVPN/openvpn/issues/945)) - this is a backport of the fixes in 2.7 plus the infrastructural changes around DCO needed to support it. For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.6.20/Changes.rst) **Windows Client**: Community MSI installer for Windows client can be found at [Community Downloads](https://openvpn.net/community-downloads/). **Linux Packages**: Instructions for installing community-maintained Linux packages can be found in the [Community Wiki](https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos). **Full Changelog**: https://github.com/OpenVPN/openvpn/compare/v2.6.19...v2.6.20 ### v2.7.1 - Date: 2026-03-31 - Version: v2.7.1 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.1 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.7.1 - **added** — Add a new `username-only` flag argument to `--auth-user-pass` which makes OpenVPN only query for username and send a dummy password to the server - **changed** — Increase default sizing of internal hash maps to `4 * --max-clients` - **changed** — When compiled with the AWS-LC SSL library, using `--tls-cert-profile` will now print a run-time warning as the library does not support it - **changed** — Systemd unit files: change LimitNPROC to TasksMax and increase limit - **changed** — port-share: log incoming connections at `verb 3`, not on `error` level anymore - **fixed** — Fix usage of `--lport` inside a `` block which got broken with the multi-socket patchset - **fixed** — Do not try to run auto-pam unit test when cross-compiling - **fixed** — Do not break private-key passphrases of length >= 64 - **fixed** — Fix obscure ASSERT() crash on TCP connects with TAP and no ip config - **fixed** — Make DCO work on FreeBSD systems that have no IPv4 support in kernel - **fixed** — Make DCO work on Linux on big endian systems (namely, MIPS and PowerPC) - **fixed** — Fixup responses to management interface ``version`` command (for >= 4) - **fixed** — Make `--enable-async-push` work on FreeBSD 15 which has native inotify support - **fixed** — Adjust some code parts to new "const" handling on string function returns (ISO C23, as implemented by glibc 2.43 and newer) ###### New features: - Add a new `username-only` flag argument to `--auth-user-pass` which will now make OpenVPN only query for username and send a dummy password to the server. This is only useful if auth schemes are used on the server side that will do some sort of external challenge base on username, and not password authentication. See discussion in GH [OpenVPN/openvpn#501](https://github.com/OpenVPN/openvpn/issues/501) (starting Jan 30, 2024). - Increase default sizing of internal hash maps to `4 * --max-clients`. The default used to be `256` with a `--max-clients` default of 1024 - this is bad for performance, while the memory savings are minimal. On a very memory constrained system, reduce `--max-clients`. ###### User-visible Changes: - When compiled with the AWS-LC SSL library, using `--tls-cert-profile` will now print a run-time warning - the library does not support it, so it would silently do nothing. - Systemd unit files: change LimitNPROC to TasksMax and increase limit (GH: [OpenVPN/openvpn#929](https://github.com/OpenVPN/openvpn/issues/929)) - Documentation improvements. - port-share: log incoming connections at `verb 3`, not on `error` level anymore (GH: [OpenVPN/openvpn#976](https://github.com/OpenVPN/openvpn/issues/976)). ###### Bugfixes: - Fix usage of `--lport` inside a `` block - this got broken with the multi-socket patchset (GH: [OpenVPN/openvpn#995](https://github.com/OpenVPN/openvpn/issues/995)) - Do not try to run auto-pam unit test when cross-compiling. - Do not break private-key passphrases of length >= 64 (GH: [OpenVPN/openvpn#993](https://github.com/OpenVPN/openvpn/issues/993)) - Fix obscure ASSERT() crash on TCP connects with TAP and no ip config. - Make DCO work on FreeBSD systems that have no IPv4 support in kernel (FreeBSD PR 286263) - Make DCO work on Linux on big endian systems (namely, MIPS and PowerPC) (GH: [OpenVPN/ovpn-dco#96](https://github.com/OpenVPN/ovpn-dco/issues/96)) - Fixup responses to management interface ``version`` command (for >= 4) - Make `--enable-async-push` work on FreeBSD 15 (which has native inotify support, and consequently no libinotify.pc anymore) - Adjust some code parts to new "const" handling on string function returns (ISO C23, as implemented by glibc 2.43 and newer). For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.1/Changes.rst) **Windows Client**: Community MSI installer for Windows client can be found at [Community Downloads](https://openvpn.net/community-downloads/). **Linux Packages**: Instructions for installing community-maintained Linux packages can be found in the [Community Wiki](https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos). **Full Changelog**: https://github.com/OpenVPN/openvpn/compare/v2.7.0...v2.7.1 ### v2.7.0 - Date: 2026-02-11 - Version: v2.7.0 - Original notes: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.0 - Permalink: https://whatsnew.fyi/product/openvpn/releases/v2.7.0 - **added** — Multi-socket support for servers to handle multiple addresses/ports/protocols within one server - **added** — Client implementations for DNS options on Linux/BSD/macOS included with the default install - **added** — New client implementation for Windows adding support for split DNS and DNSSEC - **added** — Support for server mode in win-dco driver - **added** — Support for new upstream DCO Linux kernel module - **added** — Client-side support for new PUSH_UPDATE control-channel message allowing servers to send updates to routing and DNS config without triggering a reconnect - **added** — New management interface commands push-update-broad and push-update-cid to send PUSH_UPDATE option updates - **added** — TLS 1.3 support with bleeding-edge mbedTLS versions - **added** — Support for mbedTLS version 4 - **added** — Two new environment variables to communicate desired default gateway redirection to plugins like Network Manager - **added** — Support for Epoch data channel on Windows using the win-dco driver - **changed** — The block-local flag is now enforced with WFP filters - **changed** — Windows network adapters are now generated on demand - **changed** — Windows automatic service now runs as an unpriviledged user - **changed** — Enforcement of AES-GCM usage limit in data channel - **changed** — Epoch data keys and packet format in data channel - **changed** — Recursive Routing check is now more granular and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server - **removed** — Support for the wintun driver has been removed - **removed** — win-dco is now the default driver and tap-windows6 is the fallback solution ##### Highlights of 2.7 * Multi-socket support for servers -- Handle multiple addresses/ports/protocols within one server * Improved Client support for DNS options * Client implementations for Linux/BSD/macOS, included with the default install * New client implementation for Windows, adding support for features like split DNS and DNSSEC * Architectural improvements on Windows * The `block-local` flag is now enforced with WFP filters * Windows network adapters are now generated on demand * Windows automatic service now runs as an unpriviledged user * Support for server mode in win-dco driver * Note: Support for the wintun driver has been removed. win-dco is now the default, tap-windows6 is the fallback solution for use-cases not covered by win-dco. * Improved data channel * Enforcement of AES-GCM usage limit * Epoch data keys and packet format * Support for new upstream DCO Linux kernel module * This release supports the new `ovpn` DCO Linux kernel module which will be available in future upstream Linux kernel releases. Backports of the new module to current kernels are available via the [ovpn-backports project](https://github.com/OpenVPN/ovpn-backports). * Client-side support for new `PUSH_UPDATE` control-channel message * This allows servers to send updates to options like routing and DNS config without triggering a reconnect. * PUSH_UPDATE server support (minimal) * New management interface commands `push-update-broad` and `push-update-cid` to send PUSH_UPDATE option updates. * TLS 1.3 support with bleeding-edge mbedTLS versions * Support for mbedTLS version 4 * Two new environment variables have been introduced to communicate desired default gateway redirection to plugins like Network Manager. * Support for Epoch data channel on Windows, using the win-dco driver (2.8.0+) * "Recursive Routing" check is now more granular, and will only drop packets-in-tunnel if destination IP, protocol and port matches with those needed to reach the VPN server. * COPYING: license details only relevant to our Windows installers have been updated and moved to the openvpn-build repo For details see [Changes.rst](https://github.com/OpenVPN/openvpn/blob/v2.7.0/Changes.rst) **Windows Client**: Community MSI installer for Windows client can be found at [Community Downloads](https://openvpn.net/community-downloads/). **Linux Packages**: Instructions for installing community-maintained Linux packages can be found in the [Community Wiki](https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos). **Changes since last release candidate**: https://github.com/OpenVPN/openvpn/compare/v2.7_rc6...v2.7.0