Every CVE Search/ Get API key

CVE-2026-34956

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

5.9 MediumFix available

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.40%Up 0.3 points since May 6, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.9

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Record
CVE-2026-34956
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-05
EUVDEUVD-2026-27345 5.9

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Record
EUVD-2026-27345
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-q5f5-xxh8-jx9h 5.9

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP...

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Record
GHSA-q5f5-xxh8-jx9h
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-02
NVD 5.9

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Record
CVE-2026-34956
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-120
Updated
2026-11-05
OSVDEBIAN-CVE-2026-34956 5.9

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Record
DEBIAN-CVE-2026-34956
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1871 5.9

openvswitch security update

Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.

Security Fix(es):

"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'

Record
OESA-2026-1871
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 18 moreShow less
OSVOESA-2026-1872 5.9

openvswitch security update

Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.

Security Fix(es):

"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'

Record
OESA-2026-1872
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1960 5.9

openvswitch security update

Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.

Security Fix(es):

"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'

Record
OESA-2026-1960
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1961 5.9

openvswitch security update

Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.

Security Fix(es):

"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'

Record
OESA-2026-1961
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1962 5.9

openvswitch security update

Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.

Security Fix(es):

"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'

Record
OESA-2026-1962
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-2063 5.9

openvswitch security update

Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.

Security Fix(es):

"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'

Record
OESA-2026-2063
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34956 5.9

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Record
UBUNTU-CVE-2026-34956
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-86781 No score

CVE-2026-34956 affecting package openvswitch for versions less than 3.3.0-3

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Record
AZL-86781
Updated
2026-11-02
OSVopenSUSE-SU-2026:10534-1 No score

libopenvswitch-3_7-0-3.7.1-33.1 on GA media

These are all security issues fixed in the libopenvswitch-3_7-0-3.7.1-33.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10534-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20972-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).

Changes for openvswitch:

  • Update ovn to 25.03.3
  • Bug fixes
  • Add support for special port_security prefix "VRRPv3". This prefix allows CMS to allow all required traffic for a VRRPv3 virtual router behind LSP. See ovn-nb(5) man page for more details.
  • Fixed support for fragmented traffic in the userspace datapath. Added the "acl_ct_translation" NB_Global option to enable connection tracking based L4 field translation for stateful ACLs. When enabled allows proper handling of IP fragmentation in userspace datapaths. This option may break hardware offloading and is disabled by default.
  • Added disable_garp_rarp option to logical_router table in order to disable GARP/RARP announcements by all the peer ports of this logical router.
  • Update openvswitch to 3.5.4
  • Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt
  • OVS validated with DPDK 24.11.4.
  • Fixed buffer overflow during conntrack processing of alg=ftp in userspace datapath (CVE-2026-34956) (bsc#1261273).
  • Update openvswitch to 3.5.3
Record
openSUSE-SU-2026:20972-1
Updated
2026-11-02
OSVSUSE-SU-2026:1306-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues:

  • CVE-2026-34956: invalid memory access via crafted FTP payloads in userspace conntrack flows specifying the FTP alg handler (bsc#1261273).
Record
SUSE-SU-2026:1306-1
Updated
2026-11-02
OSVSUSE-SU-2026:1439-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issue:

Security updates:

  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).

Other updates:

  • Update openvswitch to 3.5.4
Record
SUSE-SU-2026:1439-1
Updated
2026-11-02
OSVSUSE-SU-2026:1440-1 No score

Security update for openvswitch3

This update for openvswitch3 fixes the following issues:

  • CVE-2026-34956: invalid memory access via crafted FTP payloads in userspace conntrack flows specifying the FTP alg handler (bsc#1261273).
Record
SUSE-SU-2026:1440-1
Updated
2026-11-02
OSVSUSE-SU-2026:1482-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues:

  • CVE-2026-34956: invalid memory access via crafted FTP payloads in userspace conntrack flows specifying the FTP alg handler (bsc#1261273).
Record
SUSE-SU-2026:1482-1
Updated
2026-11-02
OSVSUSE-SU-2026:1871-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issue:

  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
Record
SUSE-SU-2026:1871-1
Updated
2026-11-02
OSVSUSE-SU-2026:21250-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issue:

  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
Record
SUSE-SU-2026:21250-1
Updated
2026-11-02
OSVSUSE-SU-2026:22068-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issue

  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
Record
SUSE-SU-2026:22068-1
Updated
2026-11-02
OSVSUSE-SU-2026:22145-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).

Changes for openvswitch:

  • Update ovn to 25.03.3
  • Bug fixes
  • Add support for special port_security prefix "VRRPv3". This prefix allows CMS to allow all required traffic for a VRRPv3 virtual router behind LSP. See ovn-nb(5) man page for more details.
  • Fixed support for fragmented traffic in the userspace datapath. Added the "acl_ct_translation" NB_Global option to enable connection tracking based L4 field translation for stateful ACLs. When enabled allows proper handling of IP fragmentation in userspace datapaths. This option may break hardware offloading and is disabled by default.
  • Added disable_garp_rarp option to logical_router table in order to disable GARP/RARP announcements by all the peer ports of this logical router.
  • Update openvswitch to 3.5.4
  • Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt
  • OVS validated with DPDK 24.11.4.
  • Fixed buffer overflow during conntrack processing of alg=ftp in userspace datapath (CVE-2026-34956) (bsc#1261273).
  • Update openvswitch to 3.5.3
Record
SUSE-SU-2026:22145-1
Updated
2026-11-02
OSVSUSE-SU-2026:22152-1 No score

Security update for openvswitch

This update for openvswitch fixes the following issues

  • CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
  • CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
  • CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).

Changes for openvswitch:

  • Update ovn to 25.03.3
  • Bug fixes
  • Add support for special port_security prefix "VRRPv3". This prefix allows CMS to allow all required traffic for a VRRPv3 virtual router behind LSP. See ovn-nb(5) man page for more details.
  • Fixed support for fragmented traffic in the userspace datapath. Added the "acl_ct_translation" NB_Global option to enable connection tracking based L4 field translation for stateful ACLs. When enabled allows proper handling of IP fragmentation in userspace datapaths. This option may break hardware offloading and is disabled by default.
  • Added disable_garp_rarp option to logical_router table in order to disable GARP/RARP announcements by all the peer ports of this logical router.
  • Update openvswitch to 3.5.4
  • Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt
  • OVS validated with DPDK 24.11.4.
  • Fixed buffer overflow during conntrack processing of alg=ftp in userspace datapath (CVE-2026-34956) (bsc#1261273).
  • Update openvswitch to 3.5.3
Record
SUSE-SU-2026:22152-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openvswitch
Azure Linux:3
 before 3.3.0-3
3.3.0-3
openvswitch
Debian:12
 All versions, plus listed versions
3.1.0-23.1.0-2+deb12u13.1.2-13.1.2-23.1.2-3
Show 33 moreShow less
3.1.2-43.2.0-13.2.0-23.2.2~git20231029-13.2.2~git20231029-23.3.0-13.3.0-23.3.0-33.3.0-43.3.0-53.3.0~git20240118.e802fe7-13.3.0~git20240118.e802fe7-23.3.0~git20240118.e802fe7-33.3.1-13.4.0-13.5.0-13.5.0~git20241129.2af7cef-13.5.0~git20241129.2af7cef-23.6.0-13.6.0-23.6.0-33.6.0-53.6.0-63.6.0-73.7.0-13.7.0~git20260211.8c6ebf8-1~1.gbp9127d13.7.0~git20260211.8c6ebf8-1~1.gbp9127d23.7.0~git20260211.8c6ebf8-1~1.gbp9127d33.7.1-13.7.1-23.7.1-34.0.0-14.0.0-2
 None known
openvswitch
Debian:13
 All versions, plus listed versions
3.5.0-13.6.0-13.6.0-23.6.0-33.6.0-5
Show 11 moreShow less
3.6.0-63.6.0-73.7.0-13.7.0~git20260211.8c6ebf8-1~1.gbp9127d13.7.0~git20260211.8c6ebf8-1~1.gbp9127d23.7.0~git20260211.8c6ebf8-1~1.gbp9127d33.7.1-13.7.1-23.7.1-34.0.0-14.0.0-2
 None known
openvswitch
Debian:14
 before 3.7.1-1, plus listed versions
3.5.0-13.6.0-13.6.0-23.6.0-33.6.0-5
Show 6 moreShow less
3.6.0-63.6.0-73.7.0-13.7.0~git20260211.8c6ebf8-1~1.gbp9127d13.7.0~git20260211.8c6ebf8-1~1.gbp9127d23.7.0~git20260211.8c6ebf8-1~1.gbp9127d3
3.7.1-1
openvswitch
openEuler:22.03-LTS-SP4
 before 2.12.4-9.oe2203sp4
2.12.4-9.oe2203sp4
openvswitch
openEuler:24.03-LTS-SP1
 before 3.2.1-5.oe2403sp1
3.2.1-5.oe2403sp1
openvswitch
openEuler:24.03-LTS
 before 3.2.1-5.oe2403
3.2.1-5.oe2403
openvswitch
openEuler:24.03-LTS-SP2
 before 3.2.1-5.oe2403sp2
3.2.1-5.oe2403sp2
openvswitch
openEuler:24.03-LTS-SP3
 before 3.2.1-5.oe2403sp3
3.2.1-5.oe2403sp3
openvswitch
openEuler:20.03-LTS-SP4
 before 2.12.4-11.oe2003sp4
2.12.4-11.oe2003sp4
Show 17 moreShow less
Affected packages
PackageAffectedFixed
openvswitch
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 3.5.4-150700.41.15.1
3.5.4-150700.41.15.1
openvswitch
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 3.5.4-150700.41.15.1
3.5.4-150700.41.15.1
openvswitch3
SUSE:Linux Enterprise Micro 5.5
 before 3.1.7-150500.3.28.1
3.1.7-150500.3.28.1
openvswitch
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.11.5-3.30.1
2.11.5-3.30.1
openvswitch
SUSE:Linux Micro 6.0
 before 3.1.7-5.1
3.1.7-5.1
openvswitch
SUSE:Linux Micro 6.1
 before 3.1.7-slfo.1.1_3.1
3.1.7-slfo.1.1_3.1
openvswitch
SUSE:Linux Micro 6.2
From an advisory covering 3 CVEs
 before 3.5.4-160000.4.1
3.5.4-160000.4.1
openvswitch
SUSE:Linux Enterprise Server 16.0
From an advisory covering 3 CVEs
 before 3.5.4-160000.4.1
3.5.4-160000.4.1
openvswitch
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 3 CVEs
 before 3.5.4-160000.4.1
3.5.4-160000.4.1
openvswitch
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.0-0ubuntu22.8.1-0ubuntu22.8.1-0ubuntu32.9.0~git20180205.5a39582ca-0ubuntu12.9.0-0ubuntu1
Show 9 moreShow less
2.9.2-0ubuntu0.18.04.22.9.2-0ubuntu0.18.04.32.9.5-0ubuntu0.18.04.12.9.7-0ubuntu0.18.04.22.9.8-0ubuntu0.18.04.22.9.8-0ubuntu0.18.04.32.9.8-0ubuntu0.18.04.42.9.8-0ubuntu0.18.04.52.9.8-0ubuntu0.18.04.5+esm1
 None known
openvswitch
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.12.0-0ubuntu12.12.0-0ubuntu22.12.1~git20191107.7accd1302-0ubuntu12.12.90~git20200107.af683565b-0ubuntu12.12.90~git20200107.af683565b-0ubuntu2
Show 16 moreShow less
2.12.90~git20200107.af683565b-0ubuntu32.13.0~git20200127.dbdf66c29-0ubuntu22.13.0~git20200212.15ae9db33-0ubuntu12.13.0~git20200212.15ae9db33-0ubuntu22.13.0-0ubuntu12.13.1-0ubuntu0.20.04.12.13.1-0ubuntu0.20.04.32.13.1-0ubuntu0.20.04.42.13.3-0ubuntu0.20.04.12.13.3-0ubuntu0.20.04.22.13.5-0ubuntu12.13.8-0ubuntu12.13.8-0ubuntu1.12.13.8-0ubuntu1.22.13.8-0ubuntu1.32.13.8-0ubuntu1.4
 None known
openvswitch
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.16.0-0ubuntu22.16.0-0ubuntu32.16.0-0ubuntu42.17.0~git20220105.0d1ffb7-0ubuntu12.17.0~git20220118.1b9fd88-0ubuntu1
Show 12 moreShow less
2.17.0~git20220121.109d024-0ubuntu12.17.0-0ubuntu12.17.2-0ubuntu0.22.04.12.17.2-0ubuntu0.22.04.22.17.3-0ubuntu0.22.04.12.17.3-0ubuntu0.22.04.22.17.5-0ubuntu0.22.04.22.17.7-0ubuntu0.22.04.12.17.8-0ubuntu0.22.04.12.17.9-0ubuntu0.22.04.12.17.9-0ubuntu0.22.04.22.17.12-0ubuntu0.22.04.1
 None known
openvswitch
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.2.0-13.2.0-23.2.0-2build13.2.2~git20231029-23.2.2~git20231029-2build1
Show 11 moreShow less
3.3.0~git20240118.e802fe7-23.3.0~git20240118.e802fe7-33.3.0-13.3.0-1build13.3.0-1ubuntu13.3.0-1ubuntu33.3.0-1ubuntu3.13.3.0-1ubuntu3.23.3.4-0ubuntu0.24.04.13.3.4-0ubuntu0.24.04.23.3.9-0ubuntu0.24.04.1
 None known
openvswitch
Ubuntu:25.10
 All versions, plus listed versions
3.5.0-1build13.5.1-0ubuntu13.6.0-13.6.0-23.6.0-2ubuntu0.1
 None known
openvswitch
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.6.0-23.6.0-2build13.6.0-53.6.0-63.6.0-6build1
Show 6 moreShow less
3.6.0-6ubuntu23.7.0~git20260211.8c6ebf8-1~1.gbp9127d13.7.0-13.7.0-1build13.7.1-13.7.1-2
 None known
openvswitch
openSUSE:Tumbleweed
 before 3.7.1-33.1
3.7.1-33.1
openvswitch
openSUSE:Leap 16.0
From an advisory covering 3 CVEs
 before 3.5.4-160000.4.1
3.5.4-160000.4.1

History

History
RecordedChangedSources
affectedEUVD, NVD
factsCVE List
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34956 is a medium vulnerability (CVSS 5.9) in Red Hat Fast Datapath For Rhel 7, published April 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 35th percentile. Fixed in openvswitch 3.3.0-3.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open