Skip to content
Fencer Vulns
high 8.6

CVE-2026-5367 json

Ovn: ovn: information disclosure via crafted dhcpv6 packets

published 2026-04-24 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-25421

cvss
8.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.

Patch / fix

  • Red Hat Fast Datapath for Red Hat Enterprise Linux 10 0:25.03.2-100.el10fdp, 0:25.09.2-103.el10fdp
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 0:21.12.0-145.el8fdp, 0:23.06.4-30.el8fdp
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9 0:23.06.4-30.el9fdp, 0:23.09.6-16.el9fdp, 0:24.03.7-82.el9fdp, 0:25.03.2-100.el9fdp, 0:25.09.2-103.el9fdp
  • ovn25.03 RHEL 10 25.03.2-100.el10fdp
  • ovn25.03-host RHEL 10 25.03.2-100.el10fdp
  • ovn25.03-vtep RHEL 10 25.03.2-100.el10fdp
  • ovn25.03-central RHEL 10 25.03.2-100.el10fdp
  • ovn25.09 RHEL 10 25.09.2-103.el10fdp
  • ovn25.09-host RHEL 10 25.09.2-103.el10fdp
  • ovn25.09-vtep RHEL 10 25.09.2-103.el10fdp
  • ovn25.09-central RHEL 10 25.09.2-103.el10fdp

red hat advisories RHSA-2026:22110RHSA-2026:22111RHSA-2026:11702RHSA-2026:11701RHSA-2026:11698RHSA-2026:11700

  • openvswitch Linux Micro 6.1 3.1.7-slfo.1.1_4.1
  • openvswitch SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +3 more 2.14.2-150400.24.35.1
  • openvswitch3 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 3.1.7-150500.3.31.1
  • openvswitch SLE Module for Server Applications 15 SP7, SLE Module for Package Hub 15 SP7 3.5.4-150700.41.18.1
  • openvswitch SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.5.4-160000.4.1
  • openvswitch Linux Micro 6.0 3.1.7-6.1
  • openvswitch SLES for SAP 15 SP6, SLES 15 SP6-LTSS 3.1.7-150600.33.15.1

suse advisories SUSE-SU-2026:23188-1SUSE-SU-2026:2481-1SUSE-SU-2026:2476-1SUSE-SU-2026:2475-1SUSE-SU-2026:2463-1SUSE-SU-2026:22145-1

  • openvswitch openSUSE Leap 16.0 3.5.4-160000.4.1
  • openvswitch openSUSE Tumbleweed 3.7.1-34.1

opensuse advisories openSUSE-SU-2026:20972-1openSUSE-SU-2026:10956-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-5367 updated cvss 8.6

ovn: OVN: Information disclosure via crafted DHCPv6 packets

  • Red Hat Fast Datapath for RHEL 8 ovn23.03, ovn23.03-host, ovn23.03-vtep, ovn23.03-central Red Hat Fast Datapath for RHEL 9 ovn-2021, ovn23.03, ovn-2021-host, ovn-2021-vtep, ovn23.03-host, ovn23.03-vtep, +2 more Red Hat OpenShift Container Platform 4 ovn23.06, ovn24.03, ovn24.09, ovn25.03, ovn23.06-host, ovn23.06-vtep, +7 more
    affected: workaround, no fix available
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8 ovn23.06 23.06.4-30.el8fdp, ovn-2021 21.12.0-145.el8fdp, ovn23.06-host 23.06.4-30.el8fdp, ovn23.06-vtep 23.06.4-30.el8fdp, ovn-2021-host 21.12.0-145.el8fdp, ovn-2021-vtep 21.12.0-145.el8fdp, +2 more
    fixed: vendor fix RHSA-2026:11694
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9 ovn23.06 23.06.4-30.el9fdp, ovn23.09 23.09.6-16.el9fdp, ovn24.03 24.03.7-82.el9fdp, ovn25.03 25.03.2-100.el9fdp, ovn25.09 25.09.2-103.el9fdp, ovn23.06-host 23.06.4-30.el9fdp, +14 more
    fixed: vendor fix RHSA-2026:11696
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 10 ovn25.03 25.03.2-100.el10fdp, ovn25.09 25.09.2-103.el10fdp, ovn25.03-host 25.03.2-100.el10fdp, ovn25.03-vtep 25.03.2-100.el10fdp, ovn25.09-host 25.09.2-103.el10fdp, ovn25.09-vtep 25.09.2-103.el10fdp, +2 more
    fixed: vendor fix RHSA-2026:22110
  • Red Hat Fast Datapath for RHEL 8 ovn2.11, ovn2.12, ovn2.13, ovn2.11-host, ovn2.11-vtep, ovn2.12-host, +6 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 ovn22.06, ovn22.09, ovn22.12, ovn23.03, ovn23.09, ovn22.06-host, +14 more
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
6 mo ago

Exploit prediction

0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CISA ADP 3.1 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products

  • Red Hat Fast Datapath for Red Hat Enterprise Linux 10
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 8
  • Red Hat Fast Datapath for Red Hat Enterprise Linux 9
  • Red Hat Fast Datapath for RHEL 8
  • Red Hat Fast Datapath for RHEL 9
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.