CVE-2024-5594 - AskarLabs CVE Database

CVE-2024-5594

Vendor Openvpn

Product OpenVPN

Weakness CWE-1287

Published January 6, 2025

Last update November 3, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.

Key dates

02Disclosure timeline

January 6, 2025 CVE published

November 3, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-5594 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1287.html

Related vulnerabilities

04Related CVE

CVE-2026-2454 DoS in Calls plugin via malformed msgpack in websocket request. CVE-2025-9041 Rockwell Automation FLEX 5000 I/O - Module Fault CVE-2024-48851 Remote Code Execution CVE-2023-4522 Improper Validation of Specified Type of Input in GitLab CVE-2025-59259 Windows Local Session Manager (LSM) Denial of Service Vulnerability