By 
ExpressVPN addressed a bug in the split tunneling feature that exposed the domains visited by the users to configured DNS servers.
The company opted to temporarily remove the feature in the Windows app to address the issue. The feature will be enabled in a later release when the company will fix it.
The issue was introduced in ExpressVPN Windows versions 12.23.1 – 12.72.0 from May 19, 2022, it was fixed with the release of Version 12 app for Windows.
The split tunneling feature allows users to selectively route some internet traffic in and out of the VPN tunnel, providing flexibility to those needing both local access and secure remote access simultaneously.
A bug in this feature caused DNS requests of users not to be directed to ExpressVPN's infrastructure, as they should, but to the user's internet service provider (ISP).
Usually, all DNS requests are done through ExpressVPN's logless DNS server to prevent ISPs and other organizations from tracking the domains a user visits.
However, this bug caused some DNS queries to be sent to the DNS server configured on the computer, usually a server at the user's ISP, allowing the server to track a user's browsing habits.
Attila Tomaschek, a VPN expert and staff writer at the tech publication CNET discovered the issue.
The advisory published by the company states that the issue is believed to impact less than 1% of users on a single app platform, Version 12 for Windows. The company also announced an investigation into the bug.
Users of ExpressVPN versions 12.23.1 to 12.72.0 on Windows should upgrade their client to the latest version, 12.73.0.
The latest version removes the split tunneling feature. However, ExpressVPN says they will re-introduce it in a future release when the bug is fixed.
If upgrading is impossible, disabling split tunneling should be enough to prevent the DNS request leaks, as the bug couldn't be replicated in any other mode.
