PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6329 Openvpn CVE debrief

CVE-2016-6329 is a confidentiality issue in OpenVPN tied to the use of 64-bit block ciphers. NVD describes it as making it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, with an HTTP-over-OpenVPN Blowfish-CBC example of the Sweet32 class of attacks. The NVD record lists affected OpenVPN versions up to 2.3.14 when configured with a vulnerable cipher.

Vendor
Openvpn
Product
CVE-2016-6329
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

OpenVPN administrators and security teams that still allow 64-bit block ciphers, especially Blowfish in CBC mode, in long-lived VPN sessions. Operators of environments carrying sustained traffic through OpenVPN tunnels should review cipher configuration and upgrade status first.

Technical summary

The issue is a Sweet32-style cryptographic weakness: 64-bit block ciphers become more exposed to birthday-bound collisions as traffic volume grows over long sessions. In the NVD record, the vulnerability is mapped to CVE-2002-style information exposure and cryptographic weakness categories (CWE-200 and CWE-310) and scored CVSS 3.0 5.9/Medium with network attack vector, high complexity, no privileges, and confidentiality impact only. The affected CPE range in the record is OpenVPN through 2.3.14.

Defensive priority

Medium. The impact is limited to confidentiality, but the attack can be remote and targets a common legacy cipher class that may still be enabled in older deployments.

Recommended defensive actions

  • Review OpenVPN configurations for any use of 64-bit block ciphers, especially Blowfish-CBC, and replace them with stronger, modern cipher choices supported by your OpenVPN version.
  • Upgrade OpenVPN beyond the vulnerable range listed by NVD (through 2.3.14) where feasible, and validate cipher settings after upgrade.
  • Inventory long-lived VPN tunnels and high-volume applications over OpenVPN, since the issue is specifically associated with long-duration encrypted sessions.
  • Use the OpenVPN SWEET32 vendor advisory and related vendor guidance to confirm recommended configuration changes for your deployment.
  • Verify with testing and configuration review that legacy cipher negotiation is disabled where not required by compatibility constraints.

Evidence notes

Supported by the NVD description for CVE-2016-6329, which states that OpenVPN using a 64-bit block cipher can allow remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, demonstrated with an HTTP-over-OpenVPN Blowfish-CBC scenario. The NVD data also lists affected OpenVPN versions through 2.3.14 and a CVSS 3.0 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The vendor advisory link in the NVD references is the OpenVPN SWEET32 page.

Official resources

CVE published by NVD on 2017-01-31; this debrief uses that published date for timing context.