CVE-2026-5367

EUVD-2026-25421
A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatFast Datapath for Red Hat Enterprise Linux 10
0:25.03.2-100.el10fdp ≤
𝑥
< *
ADP
Red HatFast Datapath for Red Hat Enterprise Linux 10
0:25.09.2-103.el10fdp ≤
𝑥
< *
ADP
Red HatFast Datapath for Red Hat Enterprise Linux 8
0:21.12.0-145.el8fdp ≤
𝑥
< *
ADP
Red HatFast Datapath for Red Hat Enterprise Linux 8
0:23.06.4-30.el8fdp ≤
𝑥
< *
ADP
Red HatFast Datapath for Red Hat Enterprise Linux 9
0:23.06.4-30.el9fdp ≤
𝑥
< *
ADP
Red HatFast Datapath for Red Hat Enterprise Linux 9
0:23.09.6-16.el9fdp ≤
𝑥
< *
ADP
Red HatFast Datapath for Red Hat Enterprise Linux 9
0:24.03.7-82.el9fdp ≤
𝑥
< *
ADP
Red HatFast Datapath for Red Hat Enterprise Linux 9
0:25.03.2-100.el9fdp ≤
𝑥
< *
ADP
Red HatFast Datapath for Red Hat Enterprise Linux 9
0:25.09.2-103.el9fdp ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
ovn
bookworm
vulnerable
forky
26.03.1-1
fixed
sid
26.03.1-1
fixed
trixie
no-dsa
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
libopenvswitch-2_14-0
suse enterprise server 15 SP4
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
2.14.2-150400.24.35.1
fixed
libopenvswitch-3_1-0
suse enterprise server 15 SP5
3.1.7-150500.3.31.1
fixed
suse enterprise server 15 SP6
3.1.7-150600.33.15.1
fixed
libopenvswitch-3_5-0
suse enterprise sap 15 SP7
3.5.4-150700.41.18.1
fixed
suse enterprise server 15 SP7
3.5.4-150700.41.18.1
fixed
libovn-20_06-0
suse enterprise server 15 SP4
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
20.06.2-150400.24.35.1
fixed
libovn-23_03-0
suse enterprise server 15 SP5
23.03.3-150500.3.31.1
fixed
suse enterprise server 15 SP6
23.03.3-150600.33.15.1
fixed
libovn-25_03-0
suse enterprise sap 15 SP7
25.03.3-150700.41.18.1
fixed
suse enterprise server 15 SP7
25.03.3-150700.41.18.1
fixed
openvswitch
suse enterprise sap 15 SP7
3.5.4-150700.41.18.1
fixed
suse enterprise server 15 SP4
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
3.1.7-150600.33.15.1
fixed
suse enterprise server 15 SP7
3.5.4-150700.41.18.1
fixed
openvswitch-devel
suse enterprise sap 15 SP7
3.5.4-150700.41.18.1
fixed
suse enterprise server 15 SP4
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
3.1.7-150600.33.15.1
fixed
suse enterprise server 15 SP7
3.5.4-150700.41.18.1
fixed
openvswitch-ipsec
suse enterprise sap 15 SP7
3.5.4-150700.41.18.1
fixed
suse enterprise server 15 SP4
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
3.1.7-150600.33.15.1
fixed
suse enterprise server 15 SP7
3.5.4-150700.41.18.1
fixed
openvswitch-pki
suse enterprise sap 15 SP7
3.5.4-150700.41.18.1
fixed
suse enterprise server 15 SP4
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
3.1.7-150600.33.15.1
fixed
suse enterprise server 15 SP7
3.5.4-150700.41.18.1
fixed
openvswitch-test
suse enterprise sap 15 SP7
3.5.4-150700.41.18.1
fixed
suse enterprise server 15 SP4
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
3.1.7-150600.33.15.1
fixed
suse enterprise server 15 SP7
3.5.4-150700.41.18.1
fixed
openvswitch-vtep
suse enterprise sap 15 SP7
3.5.4-150700.41.18.1
fixed
suse enterprise server 15 SP4
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
3.1.7-150600.33.15.1
fixed
suse enterprise server 15 SP7
3.5.4-150700.41.18.1
fixed
openvswitch3
suse enterprise server 15 SP5
3.1.7-150500.3.31.1
fixed
openvswitch3-devel
suse enterprise server 15 SP5
3.1.7-150500.3.31.1
fixed
openvswitch3-ipsec
suse enterprise server 15 SP5
3.1.7-150500.3.31.1
fixed
openvswitch3-pki
suse enterprise server 15 SP5
3.1.7-150500.3.31.1
fixed
openvswitch3-test
suse enterprise server 15 SP5
3.1.7-150500.3.31.1
fixed
openvswitch3-vtep
suse enterprise server 15 SP5
3.1.7-150500.3.31.1
fixed
ovn
suse enterprise sap 15 SP7
25.03.3-150700.41.18.1
fixed
suse enterprise server 15 SP4
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
23.03.3-150600.33.15.1
fixed
suse enterprise server 15 SP7
25.03.3-150700.41.18.1
fixed
ovn-central
suse enterprise sap 15 SP7
25.03.3-150700.41.18.1
fixed
suse enterprise server 15 SP4
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
23.03.3-150600.33.15.1
fixed
suse enterprise server 15 SP7
25.03.3-150700.41.18.1
fixed
ovn-devel
suse enterprise sap 15 SP7
25.03.3-150700.41.18.1
fixed
suse enterprise server 15 SP4
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
23.03.3-150600.33.15.1
fixed
suse enterprise server 15 SP7
25.03.3-150700.41.18.1
fixed
ovn-docker
suse enterprise sap 15 SP7
25.03.3-150700.41.18.1
fixed
suse enterprise server 15 SP4
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
23.03.3-150600.33.15.1
fixed
suse enterprise server 15 SP7
25.03.3-150700.41.18.1
fixed
ovn-host
suse enterprise sap 15 SP7
25.03.3-150700.41.18.1
fixed
suse enterprise server 15 SP4
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
23.03.3-150600.33.15.1
fixed
suse enterprise server 15 SP7
25.03.3-150700.41.18.1
fixed
ovn-vtep
suse enterprise sap 15 SP7
25.03.3-150700.41.18.1
fixed
suse enterprise server 15 SP4
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
20.06.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
23.03.3-150600.33.15.1
fixed
suse enterprise server 15 SP7
25.03.3-150700.41.18.1
fixed
ovn3
suse enterprise server 15 SP5
23.03.3-150500.3.31.1
fixed
ovn3-central
suse enterprise server 15 SP5
23.03.3-150500.3.31.1
fixed
ovn3-devel
suse enterprise server 15 SP5
23.03.3-150500.3.31.1
fixed
ovn3-docker
suse enterprise server 15 SP5
23.03.3-150500.3.31.1
fixed
ovn3-host
suse enterprise server 15 SP5
23.03.3-150500.3.31.1
fixed
ovn3-vtep
suse enterprise server 15 SP5
23.03.3-150500.3.31.1
fixed
python3-openvswitch
suse enterprise sap 15 SP7
3.5.4-150700.41.18.1
fixed
suse enterprise server 15 SP7
3.5.4-150700.41.18.1
fixed
python3-ovs
suse enterprise server 15 SP4
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP5
2.14.2-150400.24.35.1
fixed
suse enterprise server 15 SP6
3.1.7-150600.33.15.1
fixed
python3-ovs3
suse enterprise server 15 SP5
3.1.7-150500.3.31.1
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:11694
https://access.redhat.com/errata/RHSA-2026:11695
https://access.redhat.com/errata/RHSA-2026:11696
https://access.redhat.com/errata/RHSA-2026:11698
https://access.redhat.com/errata/RHSA-2026:11700
https://access.redhat.com/errata/RHSA-2026:11701
https://access.redhat.com/errata/RHSA-2026:11702
https://access.redhat.com/errata/RHSA-2026:22110
https://access.redhat.com/errata/RHSA-2026:22111
https://access.redhat.com/security/cve/CVE-2026-5367
https://bugzilla.redhat.com/show_bug.cgi?id=2455863
http://www.openwall.com/lists/oss-security/2026/04/20/3
http://www.openwall.com/lists/oss-security/2026/04/20/5
https://access.redhat.com/errata/RHSA-2026:11694
https://access.redhat.com/errata/RHSA-2026:11695
https://access.redhat.com/errata/RHSA-2026:11696
https://access.redhat.com/errata/RHSA-2026:11698
https://access.redhat.com/errata/RHSA-2026:11700
https://access.redhat.com/errata/RHSA-2026:11701
https://access.redhat.com/errata/RHSA-2026:11702
https://access.redhat.com/errata/RHSA-2026:22110
https://access.redhat.com/errata/RHSA-2026:22111
https://access.redhat.com/security/cve/CVE-2026-5367
https://bugzilla.redhat.com/show_bug.cgi?id=2455863
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5367.json