Access Server: CVE-2026-115877 Twisted HTTP request smuggling through proxy

Also known as: CVE-2025-3110

Impact: Negligible

Details:

OpenVPN Access Server uses the Twisted Python library for its web services. Versions of Twisted prior to 26.10.0rc1 improperly handle carriage returns in HTTP headers, potentially allowing HTTP request smuggling when deployed behind a misbehaving reverse proxy or load balancer. An attacker could exploit differences in HTTP request parsing to bypass front-end security controls or cause another user to receive an unintended response.

Access Server 3.2.0 and newer aren't vulnerable because version 3.2.0 introduced a fix for this issue (CVE-2025-3110). Older versions are potentially vulnerable when deployed behind a front-end reverse proxy. However, OpenVPN didn't support or recommend this configuration before version 3.2.0. Access Server Link, which provides reverse proxy functionality, isn't affected by this vulnerability and is available only with Access Server 3.2.0 and newer.

Exploiting this vulnerability would require intercepting an HTTPS connection and bypassing its security protections, or compromising a client or server to a degree that would make this attack method unnecessary. Furthermore, exploitation hasn't resulted in any meaningful access.

Remediation:

If you're running Access Server earlier than version 3.2.0 behind a reverse proxy or load balancer that improperly processes HTTP header values, update Access Server to version 3.2.0 or newer, or correct the issue in the reverse proxy or load balancer.

Need help?

If you have questions, submit a support ticket.