Four security fixes, three CVEs, and one breaking change for sloppy PKIs — here's how to roll 2.7.8 onto your VPN server without a Monday-morning surprise.

OpenVPN 2.7.8 shipped on October 7, 2026, and nobody is going to frame this release. There are no new protocols, no flagship features, no marketing. It's 22 commits across 40 files from 11 contributors, tagged by maintainer Gert "cron2" Doering — a maintenance release whose entire job is to harden the exact code paths that run your production VPN tunnels. That makes it one of those upgrades where the boring description hides the operational stakes.

What's actually in the release

The security section of the release notes lists four items. Three carry CVE identifiers; the fourth was deliberately left without one, and the reason is instructive.

CVE-2026-84790 — NULL bytes in certificate subjects. OpenVPN now refuses any certificate whose subject contains embedded NULL bytes. This matters mainly for OpenSSL builds: mbedTLS builds had always rejected such certificates, so this change brings the two crypto backends in line. If your PKI is sane, you'll never notice. If some ancient script-generated CA cert has a zero byte hiding in it, 2.7.8 will reject it outright — so audit before you upgrade.

CVE-2026-88964 — unsigned underflow in domain_search_list. Clearing that option could trigger an integer underflow. Not glamorous, but option-parsing bugs in a privileged daemon are exactly the kind of thing attackers probe.

CVE-2026-84256 — Windows cmd.exe argument quoting. On Windows builds, cmd.exe could expand variables inside quoted arguments. Linux operators can skip this one, but if you run mixed infrastructure, your Windows endpoints deserve the same patch day.

tls-crypt-v2 — no CVE, on principle. The client-side fix stops OpenVPN from adding a wrapped client key when no key material is available. Per the CRA guidelines, "a malicious server can stop the client from working properly" isn't CVE-worthy. It got fixed anyway. That's the part worth noticing: a project that ships unglamorous hardening without waiting for a number to justify it.

Beyond security, the DCO (Data Channel Offload) path gets meaningful stability work: stale iroutes fixed, Linux Netlink race conditions closed, and peer/key setup errors no longer take down the entire server process — only the affected client instance restarts. If you run a multi-client server under load, that last fix is the one you'll feel first.

The pre-upgrade checklist

1. Audit your certificates. The NULL-byte refusal is the one behavioral break. Run openssl x509 -in your-cert.pem -noout -subject across your server and client certs. A normal PKI never issues NULL bytes; home-grown scripts sometimes do. If you're on OpenSSL builds (most distro packages), this check is mandatory. On mbedTLS builds you were already safe.

2. Check your distro packaging lag. Distro repos trail the upstream release. If you run the official OpenVPN community repository, you'll get 2.7.8 first; distribution packages follow on their own cadence. Know which one you track before scheduling the maintenance window.

3. Stage, then watch the logs. Push to one node first. After restart, grep the server log for certificate rejections and TLS handshake errors — grep -i "certificate\|TLS Error" /var/log/openvpn/server.log is the five-second smoke test.

4. Verify DCO users benefit. If you use the kernel data channel (the ovpn DCO module on Linux), confirm the module loads against your kernel and iroutes behave after the upgrade. The Netlink fixes specifically target this setup.

5. Confirm the version. openvpn --version should report 2.7.8. Then leave it alone — until the next security release, which is precisely how OpenVPN maintenance works.

The operator's takeaway

Security releases without features are the ones sysadmins postpone. But consider what this one fixes: certificate identity validation, option parsing in a privileged process, and crash isolation on multi-client servers. These are not theoretical — they are the load-bearing walls. The upgrade takes ten minutes; the audit takes an hour. Schedule both.

Sources