CVE-2026-25804

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25804", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T19:58:01.641Z", "datePublished": "2026-02-06T22:58:35.041Z", "dateUpdated": "2026-02-09T15:25:44.301Z"}, "containers": {"cna": {"title": "Antrea has invalid enforcement order for network policy rules caused by integer overflow", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9"}, {"name": "https://github.com/antrea-io/antrea/pull/7496", "tags": ["x_refsource_MISC"], "url": "https://github.com/antrea-io/antrea/pull/7496"}, {"name": "https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa", "tags": ["x_refsource_MISC"], "url": "https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa"}], "affected": [{"vendor": "antrea-io", "product": "antrea", "versions": [{"version": "< 2.3.2", "status": "affected"}, {"version": ">= 2.4.0, < 2.4.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T22:58:35.041Z"}, "descriptions": [{"lang": "en", "value": "Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3."}], "source": {"advisory": "GHSA-86x4-wp9f-wrr9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-09T15:21:46.446442Z", "id": "CVE-2026-25804", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:25:44.301Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25804", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-09T15:21:46.446442Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T15:21:47.143Z"}}], "cna": {"title": "Antrea has invalid enforcement order for network policy rules caused by integer overflow", "source": {"advisory": "GHSA-86x4-wp9f-wrr9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "antrea-io", "product": "antrea", "versions": [{"status": "affected", "version": "< 2.3.2"}, {"status": "affected", "version": ">= 2.4.0, < 2.4.3"}]}], "references": [{"url": "https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9", "name": "https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/antrea-io/antrea/pull/7496", "name": "https://github.com/antrea-io/antrea/pull/7496", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa", "name": "https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T22:58:35.041Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25804", "state": "PUBLISHED", "dateUpdated": "2026-02-09T15:25:44.301Z", "dateReserved": "2026-02-05T19:58:01.641Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T22:58:35.041Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "antrea", "vendor": "antrea-io", "versions": [{"status": "affected", "version": "< 2.3.2"}, {"status": "affected", "version": ">= 2.4.0, < 2.4.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:antrea:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "395EA656-873E-492A-88A3-D6813376D968", "versionEndExcluding": "2.3.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:antrea:*:*:*:*:*:kubernetes:*:*", "matchCriteriaId": "7DB4CD72-9C1A-47E2-BB11-16F803BAE15A", "versionEndExcluding": "2.4.3", "versionStartIncluding": "2.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3."}, {"lang": "es", "value": "Antrea es una soluci\u00f3n de red de Kubernetes dise\u00f1ada para ser nativa de Kubernetes. Antes de las versiones 2.3.2 y 2.4.3, el sistema de asignaci\u00f3n de prioridad de pol\u00edticas de red de Antrea tiene un error de desbordamiento aritm\u00e9tico uint16 que causa c\u00e1lculos incorrectos de prioridad de OpenFlow al manejar un gran n\u00famero de pol\u00edticas con varios valores de prioridad. Esto resulta en una aplicaci\u00f3n de tr\u00e1fico potencialmente incorrecta. Este problema ha sido parcheado en la versi\u00f3n 2.4.3."}], "id": "CVE-2026-25804", "lastModified": "2026-06-17T10:25:16.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25804", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-09T15:21:46.446442Z", "version": "2.0.3"}}]}, "published": "2026-02-06T23:15:55.123", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/antrea-io/antrea/pull/7496"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:17:03.700354+00:00", "value": {"mitigation_remediation": ["Upgrade Antrea to version 2.4.3 or later to apply the fix", "Review existing network policies to ensure priority values remain within the uint16 range and avoid creating an excessive number of policies", "Restrict policy creation to administrators and audit policy changes regularly to detect potential overflow conditions"], "summary": {"action": "Immediate Patch", "impact": "Incorrect network policy enforcement"}, "threat_synthesis": {"affected_systems": "Antrea, the Kubernetes native networking solution from the Linux Foundation, is affected when running versions older than 2.3.2 or 2.4.3. Prior to these releases the priority assignment system was vulnerable to a uint16 overflow, which was addressed in release 2.4.3 of Antrea. The vulnerability impacts all clusters that rely on Antrea for policy enforcement.", "description_and_impact": "The vulnerability is an integer overflow in Antrea's network policy priority assignment, which can cause priority calculations to wrap around and produce incorrect OpenFlow priorities. This miscalculation may lead to traffic being allowed or denied contrary to the defined policies, potentially compromising confidentiality, integrity, or availability for services within a Kubernetes cluster. The weakness maps to CWE\u2011287 (Broken Authentication/Authorization) and CWE\u2011770 (Out\u2011of\u2011Bounds Errors).", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.0, indicating high severity, but the EPSS score is below 1%, suggesting current exploitation probability is low and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires the ability to create or modify many network policies within the cluster or to manipulate priority values so that the 16\u2011bit counter overflows. Such manipulation could be performed by an insider or a compromised controller, resulting in incorrect traffic enforcement."}}}}, "created": "2026-02-09T10:45:11.787102+00:00", "updated": "2026-04-17T22:30:29.585837+00:00", "vendors": ["antrea-io", "antrea-io$PRODUCT$antrea"]}