diff --git a/openvpn/Makefile b/openvpn/Makefile
index 3bd46b9c6..964b59c3f 100644
--- a/openvpn/Makefile
+++ b/openvpn/Makefile
@@ -9,14 +9,14 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openvpn
 
-PKG_VERSION:=2.6.10
+PKG_VERSION:=2.6.12
 PKG_RELEASE:=10
 
 PKG_SOURCE_URL:=\
 	https://build.openvpn.net/downloads/releases/ \
 	https://swupdate.openvpn.net/community/releases/
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=1993bbb7b9edb430626eaa24573f881fd3df642f427fcb824b1aed1fca1bcc9b
+PKG_HASH:=1c610fddeb686e34f1367c347e027e418e07523a10f4d8ce4a2c2af2f61a1929
 
 PKG_MAINTAINER:=Magnus Kroken <mkroken@gmail.com>
 
diff --git a/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch b/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
index c54277006..c327166ab 100644
--- a/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
+++ b/openvpn/patches/100-mbedtls-disable-runtime-version-check.patch
@@ -1,11 +1,11 @@
 --- a/src/openvpn/ssl_mbedtls.c
 +++ b/src/openvpn/ssl_mbedtls.c
-@@ -1535,7 +1535,7 @@ const char *
+@@ -1612,7 +1612,7 @@ const char *
  get_ssl_library_version(void)
  {
      static char mbedtls_version[30];
 -    unsigned int pv = mbedtls_version_get_number();
 +    unsigned int pv = MBEDTLS_VERSION_NUMBER;
-     sprintf( mbedtls_version, "mbed TLS %d.%d.%d",
+     snprintf(mbedtls_version, sizeof(mbedtls_version), "mbed TLS %d.%d.%d",
               (pv>>24)&0xff, (pv>>16)&0xff, (pv>>8)&0xff );
      return mbedtls_version;