Updating your app might not keep you safe: How outdated OpenVPN code leaves VPNs exposed

Date:
Wed, 29 Jul 2026 15:08:07 +0000

Description:
Our audit of Windows VPNs uncovers a graveyard of old OpenVPN configurations, with more than 50% of apps using versions over a year old.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Trust your VPN software updates keep you safe? Believe that downloading the latest release protects you from most known threats?

You might be surprised to learn that there could be a set of invisible vulnerabilities lurking inside your state-of-the-art VPN. That's because more than half of Windows VPNs we analyzed include OpenVPN code that hasnt been updated in over a year potentially leaving you exposed to a wide range of security and performance threats. OpenVPN is a protocol that determines how data is encrypted and routed between a user's device and a VPN server. Thanks to its open-source status, it became the industry's de facto standard,
serving as the foundation for many commercial VPN services.

Because OpenVPN is developed as a separate open-source project, however, VPN providers often update their apps while leaving the bundled OpenVPN component unchanged. New interfaces, bug fixes, and major features may arrive
regularly, but the code responsible for the fundamental VPN connection may be severely out of date. Cracking the kernel This July, we audited 32 Windows
VPN clients ranging from established, multinational companies to smaller, older and free apps, to check the OpenVPN version included in their latest release. You may like The most secure VPN providers: safe options for the
best security and encryption, tested by in-house experts 'They will renew
your subscription even if you turn off the auto-renewal' Which VPN has the most price complaints on the Play Store? The best VPNs for Android our top picks based on expert testing

The results were shocking. A massive 56% (18 of 32) use an OpenVPN version that is more than a year old , 41% (14) use configurations that are over two years old , 22% (7) rely on code more than four years old . And a terrifying 12.5% (4) use code that is at least five years old .

Not all providers were equal. Perhaps unsurprisingly, many of the best VPNs including NordVPN , Windscribe and Proton VPN use OpenVPN releases as recent as April 2026. At the other end of the scale, Turbo VPN and VyprVPN continue to use OpenVPN 2.4.7 from April 2019.

It might seem logical that companies with greater commercial resources are
the ones investing more into keeping the app's codebase up to date. But
having significantly older versions of the OpenVPN protocol raises
significant privacy and security concerns regardless. A variety of hidden risks So is this really a big deal?

Marijus Briedis, CTO at NordVPN, tells TechRadar: Because OpenVPN like any project regularly patches vulnerabilities, hardens its codebase, and
improves performance, running a version thats years behind might miss
security components that current up-to-date versions offer. What to read next How to choose an age verification VPN: secure yourself while verifying your age in regions such as the UK and Australia The best VPN service 2026
IPVanish just made OpenVPN almost three times faster on Windows but there's
a catch

Jason Xu, senior app developer at Windscribe, argues that previously
disclosed vulnerabilities could actually be more serious, precisely because they have been documented. An attacker doesnt even need to find a new bug; they can just read the changelog, he notes.

Indeed, OpenVPN regularly releases Common Vulnerabilities and Exposures (CVEs): six vulnerabilities were registered in 2025, six in 2024, one in
2023, and one in 2022. This means providers with older versions likely did
not adopt the upstream releases containing those fixes.

Of course, the risks have nuances. Running an older version does not necessarily mean an application is vulnerable to every newly discovered flaw. For example, if an older build does not include a feature which later caused
a vulnerability, it is unaffected.

Briedis stressed that security can be maintained through other means, including backported patches, vendor fixes, configuration mitigations and/or removing vulnerable functions. However, he said the real concern is when none of those measures are in place and when theres no visibility into whether
they are.

The issues involved can be broad and numerous. Outdated dependencies, like running an older version of OpenSSL, are just some of the potential issues.

There is also a broader maintenance cost. According to Dr. Peter Membrey, Chief Research Officer at ExpressVPN , older versions can become increasingly difficult to integrate with current operating systems and cryptographic libraries. Being several years behind can indicate a growing body of
security, compatibility, and operational debt, he says.

Ultimately, the further behind you fall, the harder each upgrade gets, Xu adds. Thats the trap. Nobody decides to be five years behind; they just keep saying next quarter. A question of stack Adopting a new OpenVPN release is a fundamental change requiring compatibility testing across platforms, regression checks, staged rollouts, and validation that nothing breaks in the software stack a process which often takes months to complete.

Because of that, VPN providers say they are not obliged to adopt every upstream release.

NortonVPN , which is in the process of moving to the cutting-edge OpenVPN version at the moment, explains that each update needs to be assessed and tested carefully to make sure it delivers clear benefits without introducing stability, performance, or compatibility issues for customers.

Indeed, Karolis Kaciulis, Leading System Engineer at Surfshark , agrees that
a six-to-18-month delay can be reasonable provided critical vulnerabilities are addressed promptly.

Some VPN providers whose updates date back more than two years have cited specific reasons to justify the delay.

StrongVPN, for example, states that work on its proprietary internal protocol has postponed the planned update to OpenVPN 2.7. Meanwhile, ClearVPN claims
to ensure security by applying its own security patches.

Finally, PureVPN states that it is staying with OpenVPN 2.6.12 because it has developed custom technologies based on that version and because OpenVPN 2.7 removes support for the Wintun driver. Time to DIY So what can you do? Is it time to shun anyone not using the most recent version of OpenVPN?

Not necessarily. Many providers now use newer protocols like WireGuard by default, which generally benefit from more active maintenance.

In fact, several providers are in the process of phasing out OpenVPN support for faster, more agile protocols.

Proton VPN is one of the providers keeping pace, running one of the most recent OpenVPN builds on its Windows app. However, a spokesperson said that over time, the company "will start to phase out OpenVPN support in our client apps" while retaining the protocol on servers for legacy routers and older devices.

The spokesperson also noted that the protocol is "slow and bloated" in comparison to Proton VPN's Stealth and WireGuard protocols, though OpenVPN remains "robustly secure."

So whether you're using an app with the latest OpenVPN configuration or not, it might be worth switching protocols anyway.

But if you really want to know, you can audit your VPN by checking the client settings, diagnostic logs, or official release notes to confirm which version of OpenVPN your provider is using and when it was last updated.

A key red flag is protocol dependencies that are more than 12 to 18 months
old without a documented security or compatibility reason as it may suggest that critical security updates have been delayed.

If you're still unsure, you can always contact your VPN provider's support team to receive more transparent info about timelines for protocol updates
and security patches.

Ultimately, the risk to your security may well be limited. However, in the world of VPNs where attention to detail in regards to security is the currency of providers one might well ask: Why not simply support the latest and most secure option?

Why not indeed Today's best NordVPN, Surfshark, ExpressVPN and Proton VPN deals NordVPN 2 Year 2.59 /mth View +3 months free Surfshark 24 Months 1.79 /mth View ExpressVPN 24 month 1.99 /mth View Proton VPN 24 Month 2.39 /mth View We check over 250 million products every day for the best prices



======================================================================
Link to news story: https://www.techradar.com/vpn/vpn-services/updating-your-app-might-not-keep-yo u-safe-how-outdated-openvpn-code-leaves-vpns-exposed


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)