openvpn

Bugfixes:

• using --dns server ... style configs on Windows with win-dco would
  lead to erroneously enabling "DnsSecValidationRequired : True", possibly
  breaking VPN DNS resolution. Pushing --dns server ... dnssec no
  can be used as a workaround until clients can be updated.
  (Github: openvpn#1024)
• correct comments in the --dns-up-down platform scripts relating to
  dns_server_..._dnssec values.
• fix release-only build of pkcs11-helper vcpkg port, do not try to
  install files from debug build.
• mbedTLS builds will now provide a proper error message if a
  tls-group statement with no valid groups is encountered
  (used to run into SSL handshake failure later on).
• --enable-strict and --enable-strict-options configure flags have
  been removed (because they did not actually do anything anymore)

For details see Changes.rst

Windows Client: Community MSI installer for Windows client can be found at Community Downloads.

Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.

Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.3...v2.7.4

Bugfixes:

• in combination with --management-query-passwords, setups using
  --auth-user-pass file or inline auth-user-pass would no longer
  use the configured passwords and prompt on the management interface
  instead (OpenVPN GUI would then provide an empty user/password prompt)
  (Github: openpvn#1021).

For details see Changes.rst

Windows Client: Community MSI installer for Windows client can be found at Community Downloads.

Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.

Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.2...v2.7.3

Security fixes:

• CVE-2026-40215: fix race condition in TLS handshake that could lead to leaking of
  packet data from a previous handshake under specific circumstances
• CVE-2026-35058: fix server ASSERT() on receiving a suitably malformed packet with
  a valid tls-crypt-v2 key

New features:

• management interface: permit input of very long passwords in
  base64-encoded multiline format. Signal support to management
  clients via "management version 6".

User-visible Changes:

• improve error messages on --verify-x509-name failures
• improve error logging when overlong username or passwords can not
  be written to TLS buffer

Bugfixes:

• when using a config file with inlined username and no password,
  fix prompting for the password from management interface.
• Windows: fix DNSSEC flag handling - this got never applied due to
  a bad comparison being always false.
• Windows: fix deinstallation progress bar on adapter deletion.

For details see Changes.rst

Windows Client: Community MSI installer for Windows client can be found at Community Downloads.

Linux Packages: Instructions for installing community-maintained Linux packages can be found in the Community Wiki.

Full Changelog: https://github.com/OpenVPN/openvpn/compare/v2.7.1...v2.7.2