Skip to content
Fencer Vulns
medium 5.9

CVE-2026-34956 json

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

published 2026-05-05 6 mo ago modified 2026-11-05 3 d ago also EUVD-2026-27345

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 35%
public exploits
0
none known

Summary

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Patch / fix

  • openvswitch Debian 14 3.7.1-1

debian advisories DEBIAN-CVE-2026-34956

  • openvswitch SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.5.4-160000.4.1
  • openvswitch Linux Micro 6.1 3.1.7-slfo.1.1_3.1
  • openvswitch Linux Micro 6.0 3.1.7-5.1
  • openvswitch3 SLE Micro 5.5 3.1.7-150500.3.28.1
  • openvswitch SLE Module for Server Applications 15 SP7, SLE Module for Package Hub 15 SP7 3.5.4-150700.41.15.1
  • openvswitch SLES LTSS Extended Security 12 SP5 2.11.5-3.30.1

suse advisories SUSE-SU-2026:22145-1SUSE-SU-2026:22152-1SUSE-SU-2026:22068-1SUSE-SU-2026:21250-1SUSE-SU-2026:1482-1SUSE-SU-2026:1440-1

  • openvswitch openSUSE Leap 16.0 3.5.4-160000.4.1
  • openvswitch openSUSE Tumbleweed 3.7.1-33.1

opensuse advisories openSUSE-SU-2026:20972-1openSUSE-SU-2026:10534-1

  • openvswitch Azure Linux 3.0 3.3.0-3

azure linux advisories AZL-86781

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-34956 updated cvss 5.9

openvswitch: Open vSwitch: Denial of Service via malformed FTP EPASV command

  • Red Hat Fast Datapath for RHEL 7 ovn2.11, ovn2.12, openvswitch, ovn2.11-host, ovn2.11-vtep, ovn2.12-host, +28 more Red Hat Fast Datapath for RHEL 8 ovn2.11, ovn2.12, ovn2.11-host, ovn2.11-vtep, ovn2.12-host, ovn2.12-vtep, +36 more Red Hat Fast Datapath for RHEL 9 openvswitch3.0, openvswitch3.1, openvswitch3.2, openvswitch3.3, openvswitch3.4, openvswitch3.5, +27 more Red Hat Enterprise Linux 7 openvswitch, openvswitch-test, python-openvswitch, openvswitch-controller Red Hat OpenShift Container Platform 4 openvswitch3.0, openvswitch3.1, openvswitch2.17, openvswitch3.0-test, openvswitch3.1-test, openvswitch2.17-test, +9 more Red Hat OpenStack Platform 13 (Queens) rhosp13/openstack-ovn-base, rhosp13/openstack-openvswitch-base, rhosp13/openstack-neutron-openvswitch-agent
    +3 more products
    Red Hat OpenStack Platform 16.2 rhosp-ovn, rhosp-ovn-host, rhosp-ovn-vtep, rhosp-openvswitch, rhosp-ovn-central, python3-rhosp-openvswitch, +2 more Red Hat OpenStack Platform 17.1 rhosp-ovn, rhosp-ovn-host, rhosp-ovn-vtep, rhosp-openvswitch, rhosp-ovn-central, python3-rhosp-openvswitch, +2 more Red Hat OpenStack Platform 18.0 rhoso-openvswitch
    affected: workaround, no fix available “Optionally, avoid using alg=ftp flows. These are not usually configured.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Fast Datapath for RHEL 7
  • Red Hat Fast Datapath for RHEL 8
  • Red Hat Fast Datapath for RHEL 9
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.1
  • Red Hat Red Hat OpenStack Platform 18.0

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.