CVE-2010-3902: Infradead Openconnect

Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days.

OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.

Affected products

• Infradead Openconnect: up to and including 2.25; version 1.00 only; version 1.10 only; version 1.20 only; version 1.30 only; version 2.22 only

Published 2010-10-14. Last modified 2026-06-16.