Access Server: CVE-2026-114605 DNS Python resource exhaustion

Also Known As: Uncontrolled Recursion, Unchecked Input for Loop Condition

Impact on Access Server: Minor

Details:

OpenVPN Access Server uses the dnspython library for the domain routing feature in its DNS proxy. The DNS proxy acts as a DNS server for VPN clients, allowing them to resolve domain names to internal IP addresses accessible through the VPN tunnel.

A malicious user can craft a DNS wire-format message containing cyclic or deeply nested compression pointers. When the Access Server DNS proxy processes this message, the parser can enter a continuous loop, causing excessive CPU usage, blocking execution threads, and potentially degrading performance or crashing the application. No confidential data is exposed.

The likelihood of exploitation is low because this attack vector is primarily accessible to trusted VPN users.

OpenVPN Access Server versions 3.1.0 through 3.2.3 are affected. Version 3.2.4 and later include a fix for this vulnerability.

Remediation:

Update Access Server to version 3.2.4 or later.

Need Help?

If you have questions, submit a support ticket.