CVE-2016-6329: Openvpn

Medium severity, CVSS 5.9. EPSS: 5.9% chance of exploitation in the next 30 days.

OpenVPN, when using a 64-bit block cipher, makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTP-over-OpenVPN session using Blowfish in CBC mode, aka a "Sweet32" attack.

Affected products

• Openvpn Openvpn: up to and including 2.3.14

Published 2017-01-31. Last modified 2026-06-17.