VPNs: Outdated Code Poses Hidden Dangers

An audit of 32 Windows VPN clients revealed that over half, specifically 56%, are utilizing OpenVPN versions that are more than a year old. Some applications are even relying on code that is over five years old. This outdatedness is concerning because the OpenVPN protocol is fundamental to how VPNs encrypt and route data. While VPN providers regularly update their interfaces and features, the underlying OpenVPN component often remains unpatched.

This can lead to serious security and performance risks. Running older OpenVPN versions means missing out on critical security patches for known vulnerabilities, such as those detailed in CVEs released annually. While some providers implement workarounds, the lack of transparency regarding these fixes is a concern. Older code can also lead to compatibility issues with modern operating systems and cryptographic libraries.

Many VPN services acknowledge the challenge of updating OpenVPN due to the extensive testing required across different platforms. Some, like PureVPN and StrongVPN, have cited custom development or proprietary protocols as reasons for sticking with older versions. As a solution, many providers are shifting towards newer, more actively maintained protocols like WireGuard, with some planning to phase out OpenVPN support entirely over time.