[Openvpn-announce] OpenVPN 2.7_rc3 released

[Yuriy D. <yur...@op...>]

The OpenVPN community project team is proud to release OpenVPN 2.7_rc3.

This is the third release candidate for the feature release 2.7.0.

Security fixes:

* CVE-2025-13751: Windows/interactive service: fix bug where the interactive service would error-exit in
  certain error conditions instead of just logging the fact and
  continuing.  After the error-exit, OpenVPN connections will no
  longer work until the service is restarted (or the system rebooted).
  This can be triggered by any authenticated local user, and has
  thus been classified as a "local denial of service" attack.

Important bug fixes since 2.7_rc2:

* Windows/Interactive Service bugfixes:
  many small bugfixes to registry-related DNS domain handling
* Windows/Interactive Service: harden service pipe handling
  close a small race condition, and add restrictive ACLs
* more type conversion related warnings have been fixed
* --multihome behaviour regarding egress interface selection has been
  changed. See Changes.rst and manpage for details.
* cleanup dead code in event handling code (leftover of the multisocket
  patch set)
* add new feature, --tls-crypt-v2-max-age n.  See Changes.rst and
  manpage for details.
* improve documentation to point out the pitfalls of case-insensitive
  filesystems and --client-config-dir
* split default gateway query logic in two: 
    * for --redirect-gateway functionality, query for the gateway towards 
      the actual IP address of the VPN server connecting to
    * for the "net_gateway" special destination for --route, and the 
      corresponding environment variable, always query for 0.0.0.0 / ::
  (this will only make a difference in certain scenarios using a local 
  proxy, or on a system with multiple interfaces, not using the "default
  route" for the VPN connection * see github#890)
* upgrade embedded pkcs11-helper vcpkg + pkcs11-uri patch to 1.31 
* CMake / autoconf cleanup wrt unused checks, outdated old-Linux checks, 
  Windows oddities
* DCO (primarily Linux): improve handling of bulk notifications from
  kernel (do not lose notifications, do not crash) (github#900)

More details can be found in the Changes document:

<https://github.com/OpenVPN/openvpn/blob/master/Changes.rst>

Source code and Windows installers can be downloaded from our download page:

<https://openvpn.net/community-downloads/>

Packages for Debian, Ubuntu, Fedora, RHEL, and openSUSE are available in the various
official Community repositories:

<https://community.openvpn.net/Pages/OpenVPN%20software%20repos>

Kind regards,
Yuriy Darnobyt