Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 19

Export CSV
CVE-2026-34956

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Fast Datapath Openshift and 5 more
CVE-2026-36499

openvswitch: Open vSwitch: Denial of service via resource exhaustion due to missing upper-bound check

A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to request an excessive number of handler or revalidation threads. This can cause a denial of service (DoS) via resource exhaustion.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Openvswitch
CVE-2020-27827

lldp/openvswitch: denial of service via externally triggered memory leak

A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Fedoraproject Lldpd Project Openvswitch and 2 more
Products
Fedora Lldpd Openvswitch and 25 more
CVE-2023-3966

Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet

A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Fedoraproject Openvswitch Redhat
Products
Fedora Openvswitch Enterprise Linux and 1 more
CVE-2021-36980

openvswitch: use-after-free in decode_NXAST_RAW_ENCAP during the decoding of a RAW_ENCAP action

Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Openvswitch Redhat
Products
Openvswitch Enterprise Linux Openshift
CVE-2020-35498

openvswitch: limitation in the OVS packet parsing in userspace leads to DoS

A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 8.0% KEV · Not listed
Vendors
Debian Fedoraproject Openvswitch and 1 more
Products
Debian Linux Fedora Openvswitch and 2 more
CVE-2017-9264

openvswitch: Buffer over-read while parsing malformed TCP, UDP and IPv6 packets

In lib/conntrack.c in the firewall implementation in Open vSwitch (OvS) 2.6.1, there is a buffer over-read while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp` that can be triggered remotely.

CVSS 3.0 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Openvswitch Redhat
Products
Openvswitch Enterprise Linux Openstack
CVE-2017-9214

openvswitch: Integer underflow in the ofputil_pull_queue_get_config_reply10 function

In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`.

CVSS 3.1 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Debian Openvswitch Redhat
Products
Debian Linux Openvswitch Enterprise Linux and 3 more
CVE-2017-9263

openvswitch: Invalid processing of a malicious OpenFlow role status message

In Open vSwitch (OvS) 2.7.0, while parsing an OpenFlow role status message, there is a call to the abort() function for undefined role status reasons in the function `ofp_print_role_status_message` in `lib/ofp-print.c` that may be leveraged toward a remote DoS attack by a malicious switch.

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Openvswitch Redhat
Products
Openvswitch Enterprise Linux Openstack
CVE-2017-9265

openvswitch: Buffer over-read while parsing the group mod OpenFlow message

In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in `lib/ofp-util.c` in the function `ofputil_pull_ofp15_group_mod`.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Openvswitch Redhat
Products
Openvswitch Enterprise Linux Openstack
CVE-2016-2074

openvswitch: MPLS buffer overflow vulnerability

Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets, as demonstrated by a long string in an ovs-appctl command.

CVSS 3.0 · 9.8 Critical EPSS 6.4% KEV · Not listed
Vendors
Openvswitch Redhat
Products
Openvswitch Openshift Openstack
CVE-2023-5366

Openvswitch don't match packets on nd_target field

A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Openvswitch Redhat
Products
Openvswitch Enterprise Linux Fast Datapath and 4 more
CVE-2022-0669

dpdk: sending vhost-user-inflight type messages could lead to DoS

A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dpdk Openvswitch Redhat
Products
Data Plane Development Kit Openvswitch Enterprise Linux and 1 more
CVE-2021-3905

openvswitch: External triggered memory leak in Open vSwitch while processing fragmented packets

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Canonical Fedoraproject Openvswitch and 1 more
Products
Ubuntu Linux Fedora Openvswitch and 2 more
CVE-2018-17206

openvswitch: Buffer over-read in lib/ofp-actions.c:decode_bundle()

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue during BUNDLE action decoding.

CVSS 3.1 · 4.9 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Openvswitch and 1 more
Products
Ubuntu Linux Debian Linux Openvswitch and 2 more
CVE-2018-17205

openvswitch: Error during bundle commit in ofproto/ofproto.c:ofproto_rule_insert__() allows for crash

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a group id that does not exist), OvS tries to revert back all previous flows that were successfully applied from the same bundle. This is possible since OvS maintains list of old flows that were replaced by flows from the bundle. While reinserting old flows, OvS has an assertion failure due to a check on rule state != RULE_INITIALIZED. This would work for new flows, but for an old flow the rule state is RULE_REMOVED. The assertion failure causes an OvS crash.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Canonical Openvswitch Redhat
Products
Ubuntu Linux Openvswitch Enterprise Linux and 1 more
CVE-2018-17204

openvswitch: Mishandle of group mods in lib/ofp-util.c:parse_group_prop_ntr_selection_method() allows for assertion failure

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod, it validates the group type and command after the whole group mod has been decoded. The OF1.5 decoder, however, tries to use the type and command earlier, when it might still be invalid. This causes an assertion failure (via OVS_NOT_REACHED). ovs-vswitchd does not enable support for OpenFlow 1.5 by default.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Openvswitch and 1 more
Products
Ubuntu Linux Debian Linux Openvswitch and 2 more