OpenVPN Release 2.6.20

version.m4, ChangeLog, Changes.rst

Author: cron2

ChangeLog

@@ -1,6 +1,37 @@
 OpenVPN ChangeLog
 Copyright (C) 2002-2025 OpenVPN Inc <sales@openvpn.net>
 
+2026.04.22 -- Version 2.6.20
+
+Arne Schwabe (2):
+      DCO Linux: Fix setting DCO ifmode failing on big endian archs
+      Ensure that buffer of freed session are not used
+
+Frank Lichtenheld (2):
+      auth-pam: fix discards 'const' qualifier from pointer target type
+      openvpnmsica: Fix setting of iTicks in schedule_adapter_delete
+
+Gert Doering (4):
+      configure.ac: adjust to native inotify support for FreeBSD 15+
+      dco_freebsd: use AF_LOCAL sockets for ioctl() communication with DCO driver
+      Fix copyright line in README
+      OpenVPN Release 2.6.20
+
+Ralf Lici (5):
+      management: stop bytecount on client disconnection
+      doc: fix client-nat syntax and examples
+      dco: port core/context infrastructure needed for backport of commit 7791f53
+      dco: backport immediate notification processing on Linux and FreeBSD
+      dco-linux: enforce ifindex only for DEL_PEER notifications
+
+Rudi Heitbaum (2):
+      ntlm: fix discards 'const' qualifier from pointer target type
+      dns: fix discards 'const' qualifier from pointer target type
+
+Steffan Karger (1):
+      tls-crypt-v2: Avoid interpreting opcode as part of WKc
+
+
 2026.02.04 -- Version 2.6.19
 
 Arne Schwabe (1):

Changes.rst

@@ -1,3 +1,47 @@
+Overview of changes in 2.6.20
+=============================
+Security fixes
+--------------
+- fix race condition in TLS handshake that could lead to leaking of
+  packet data from a previous handshake under specific circumstances
+  (CVE-2026-40215)
+
+  (Bug found by XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com))
+
+- fix server ASSERT() on receiving a suitably malformed packet with
+  a valid tls-crypt-v2 key (CVE-2026-35058)
+
+  (Bug found by XlabAI Team of Tencent Xuanwu Lab (xlabai@tencent.com),
+   and independently by Emma Reuter of Cisco ASIG (TALOS-2026-2381))
+
+Bugfixes
+--------
+- management: stop periodic bytecount output on mgmt client disconnection
+
+- FreeBSD: make DCO work on systems with no IPv4 support
+
+- FreeBSD: fix compilation with --enable-async-push on FreeBSD 15
+
+- Linux: make DCO work on big endian architectures (MIPS, PowerPC)
+
+- Windows: fix deinstallation progress bar on adapter deletion.
+
+- Linux: fix problem with DCO kernel notifications getting lost, leading
+  to overcounting of number of connected clients and general confusion
+  between kernel and userland regarding peer status (Github #900, #918,
+  #931, #919, #945) - this is a backport of the fixes in 2.7 plus the
+  infrastructural changes around DCO needed to support it.
+
+Documentation updates
+---------------------
+- fix ``client-nat`` syntax and examples
+
+Code maintenance / Compat changes
+---------------------------------
+- adjust some 'const' qualifiers to ISO C23 updates in glibc-2.43
+  (namely some strstr(), strchr() and strrchr() uses)
+
+
 Overview of changes in 2.6.19
 =============================
 Bugfixes

version.m4

@@ -3,12 +3,12 @@ define([PRODUCT_NAME], [OpenVPN])
 define([PRODUCT_TARNAME], [openvpn])
 define([PRODUCT_VERSION_MAJOR], [2])
 define([PRODUCT_VERSION_MINOR], [6])
-define([PRODUCT_VERSION_PATCH], [.19])
+define([PRODUCT_VERSION_PATCH], [.20])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MAJOR])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_MINOR], [[.]])
 m4_append([PRODUCT_VERSION], [PRODUCT_VERSION_PATCH], [[]])
 define([PRODUCT_BUGREPORT], [openvpn-users@lists.sourceforge.net])
-define([PRODUCT_VERSION_RESOURCE], [2,6,19,0])
+define([PRODUCT_VERSION_RESOURCE], [2,6,20,0])
 dnl define the TAP version
 define([PRODUCT_TAP_WIN_COMPONENT_ID], [tap0901])
 define([PRODUCT_TAP_WIN_MIN_MAJOR], [9])