Skip to content
Fencer Vulns
high 7.5

CVE-2021-3905 json

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing.

published 2022-08-23 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-27133

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.

Patch / fix

  • openvswitch openvswitch 2.17.0
  • openvswitch2.16 RHEL 8 2.16.0-86.el8fdp
  • openvswitch2.16-test RHEL 8 2.16.0-86.el8fdp
  • openvswitch2.16-ipsec RHEL 8 2.16.0-86.el8fdp
  • python3-openvswitch2.16 RHEL 8 2.16.0-86.el8fdp
  • network-scripts-openvswitch2.16 RHEL 8 2.16.0-86.el8fdp
  • openvswitch2.13 RHEL 8 2.13.0-139.el8fdp
  • openvswitch2.13-test RHEL 8 2.13.0-139.el8fdp
  • openvswitch2.13-ipsec RHEL 8 2.13.0-139.el8fdp

red hat advisories RHBA-2022:5792RHBA-2022:0051RHBA-2022:0052

  • openvswitch Arch Linux 2.16.1-1

arch linux advisories AVG-2516

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3905 updated cvss 7.5

openvswitch: External triggered memory leak in Open vSwitch while processing fragmented packets

  • Red Hat Fast Datapath for RHEL 7 openvswitch2.12, openvswitch2.13, openvswitch2.12-test, openvswitch2.13-test, openvswitch2.13-ipsec, python-openvswitch2.12, +1 more Red Hat Fast Datapath for RHEL 8 openvswitch2.12, openvswitch2.12-test, python3-openvswitch2.12, network-scripts-openvswitch2.12 Red Hat Enterprise Linux 7 openvswitch, openvswitch-test, python-openvswitch, openvswitch-controller
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openvswitch2.13, openvswitch2.15, openvswitch2.16, openvswitch2.13-test, openvswitch2.15-test, openvswitch2.16-test, +8 more
    affected: no fix planned “Will not fix”
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 openvswitch2.15 2.15.0-55.el8fdp, openvswitch2.16 2.16.0-86.el8fdp, openvswitch2.13 2.13.0-139.el8fdp, openvswitch2.15-test 2.15.0-55.el8fdp, openvswitch2.16-test 2.16.0-86.el8fdp, openvswitch2.13-test 2.13.0-139.el8fdp, +9 more
    fixed: vendor fix RHBA-2022:0051
  • Red Hat Fast Datapath for RHEL 7 openvswitch, openvswitch2.11, openvswitch-test, python-openvswitch, openvswitch-ovn-host, openvswitch-ovn-vtep, +5 more Red Hat Fast Datapath for RHEL 8 openvswitch2.11, openvswitch2.11-test, python3-openvswitch2.11, network-scripts-openvswitch2.11 Red Hat OpenStack Platform 10 (Newton) openvswitch, openvswitch-test, python-openvswitch, openvswitch-ovn-host, openvswitch-ovn-vtep, openvswitch-ovn-common, +2 more Red Hat OpenStack Platform 13 (Queens) openvswitch, openvswitch2.11, openvswitch-test, rhosp-openvswitch, python-openvswitch, openvswitch-ovn-host, +11 more Red Hat OpenStack Platform 16.1 rhosp-ovn, rhosp-ovn-host, rhosp-ovn-vtep, rhosp-openvswitch, rhosp-ovn-central, python3-rhosp-openvswitch Red Hat OpenStack Platform 16.2 rhosp-ovn, rhosp-ovn-host, rhosp-ovn-vtep, rhosp-openvswitch, rhosp-ovn-central, python3-rhosp-openvswitch, +1 more
    +1 more products
    Red Hat Virtualization 4 openvswitch2.11, openvswitch2.11-test, python-openvswitch2.11
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.13% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/openvswitch/ovs-issues/issues/226 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • n/a openvswitch (ovs)

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.