CVE-2023-46849: Debian Linux

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.

Affected products

• Debian Debian Linux: version 12.0 only
• Fedoraproject Fedora: version 39 only
• Openvpn Openvpn: from 2.6.0, up to and including 2.6.6
• Openvpn Openvpn Access Server: from 2.11.0, up to and including 2.11.3; version 2.12.0 only; version 2.12.1 only

Published 2023-11-11. Last modified 2026-06-17.