PT-2025-38496 · Unknown · Purevpn Cli Client+1

Anagogistis · Published 2025-09-18 · Updated 2025-09-22 · CVE-2025-59691

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PureVPN versions 2.0.1 (CLI client) and 2.10.0 (GUI client)

Description PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel during network events, such as Wi-Fi reconnects or system resume. The CLI client auto-reconnects but fails to route or block IPv6 traffic. The GUI client maintains an IPv6 connection after disconnection until a reconnect is initiated. This exposes the user’s real IPv6 address, violating user privacy and defeating IPv6 leak protection.

Recommendations Update the CLI client to a version later than 2.0.1. Update the GUI client to a version later than 2.10.0.

Fix

Weakness Enumeration

CWE-669

Related Identifiers

CVE-2025-59691

Affected Products

Purevpn Cli Client

Purevpn Gui Client

References · 12

• https://ubuntu.com/security/CVE-2025-59691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59691 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-59691 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-59691 · Vendor Advisory
• https://twitter.com/TechNadu/status/1970056642189513180 · Twitter Post
• https://twitter.com/anagogistis/status/1968937621310132305 · Twitter Post
• https://t.me/CVEtracker/32893 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1968930866660347954 · Twitter Post
• https://anagogistis.com/posts/purevpn-ipv6-leak · Note
• https://t.me/cveNotify/135898 · Telegram Post
• https://reddit.com/r/TechNadu/comments/1nnhxbv/purevpns_linux_clients_are_leaking_ipv6_traffic · Reddit Post
• https://twitter.com/CVEnew/status/1969110926180913600 · Twitter Post