{"id":"CVE-2021-3905","aliases":["EUVD-2021-27133","GHSA-w2f8-jf7v-2cj4","OESA-2022-1778","RHBA-2022:0051","RHBA-2022:0052","RHBA-2022:5792","UBUNTU-CVE-2021-3905"],"status":"published","title":"A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An...","description":"A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02188,"percentile":0.82572,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2021-11-08T00:00:00Z","modified":"2026-10-20T14:26:20Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP1","package":"openvswitch","fixed_in":["2.12.0-16.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"openvswitch","fixed_in":["2.12.0-18.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"openvswitch","fixed_in":["2.12.0-22.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"network-scripts-openvswitch2.13","fixed_in":["0:2.13.0-139.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13","fixed_in":["0:2.13.0-139.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-debuginfo","fixed_in":["0:2.13.0-139.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-debugsource","fixed_in":["0:2.13.0-139.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-devel","fixed_in":["0:2.13.0-139.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-ipsec","fixed_in":["0:2.13.0-139.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-test","fixed_in":["0:2.13.0-139.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.13","fixed_in":["0:2.13.0-139.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.13-debuginfo","fixed_in":["0:2.13.0-139.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"network-scripts-openvswitch2.15","fixed_in":["0:2.15.0-55.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15","fixed_in":["0:2.15.0-55.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-debuginfo","fixed_in":["0:2.15.0-55.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-debugsource","fixed_in":["0:2.15.0-55.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-devel","fixed_in":["0:2.15.0-55.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-ipsec","fixed_in":["0:2.15.0-55.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-test","fixed_in":["0:2.15.0-55.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.15","fixed_in":["0:2.15.0-55.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.15-debuginfo","fixed_in":["0:2.15.0-55.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"network-scripts-openvswitch2.16","fixed_in":["0:2.16.0-86.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16","fixed_in":["0:2.16.0-86.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-debuginfo","fixed_in":["0:2.16.0-86.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-debugsource","fixed_in":["0:2.16.0-86.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-devel","fixed_in":["0:2.16.0-86.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-ipsec","fixed_in":["0:2.16.0-86.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-test","fixed_in":["0:2.16.0-86.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.16","fixed_in":["0:2.16.0-86.el8fdp"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.16-debuginfo","fixed_in":["0:2.16.0-86.el8fdp"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-16.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-18.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-22.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"network-scripts-openvswitch2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-139.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-139.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-139.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-139.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-139.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-ipsec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-139.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.13-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-139.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-139.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.13-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.13.0-139.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"network-scripts-openvswitch2.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-55.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-55.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-55.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-55.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-55.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-ipsec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-55.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.15-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-55.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-55.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.15-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.15.0-55.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"network-scripts-openvswitch2.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-86.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-86.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-86.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-86.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-86.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-ipsec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-86.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"openvswitch2.16-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-86.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-86.el8fdp"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"python3-openvswitch2.16-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.0-86.el8fdp"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openvswitch","product":"openvswitch"},{"vendor":"redhat","product":"enterprise_linux_fast_datapath"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2019692","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3905","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2021-3905","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/openvswitch/ovs-issues/issues/226","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202311-16","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3905","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w2f8-jf7v-2cj4"},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1778","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2022:0051","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028547","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_0051.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3905","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHBA-2022:0052","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2018365","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2028577","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_0052.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2022:5792","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104539","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_5792.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5242-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3905","description":"A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.","status":"published","published":"2022-08-23T00:00:00Z","modified":"2024-08-03T17:09:09.615Z","cwes":["CWE-401"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-27133","description":"A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.","status":"published","published":"2022-08-23T00:00:00Z","modified":"2024-08-03T17:09:09Z","updated_at":"2026-11-03T03:25:11.376657Z"}],"ghsa":[{"id":"GHSA-w2f8-jf7v-2cj4","title":"A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An...","description":"A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.","status":"published","published":"2022-08-24T00:00:29Z","modified":"2023-11-26T12:30:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:55:06.860566Z"}],"nvd":[{"id":"CVE-2021-3905","description":"A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.","status":"published","published":"2022-08-23T16:15:10.177Z","modified":"2026-06-17T04:05:57.907Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-3905","description":"A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.","status":"published","published":"2022-08-23T16:15:10.177Z","modified":"2026-10-20T14:26:20.964618155Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"OESA-2022-1778","title":"openvswitch security update","description":"Open vSwitch is a production quality, multilayer virtual switch licensed under the open source Apache 2.0 license.\r\n\r\nSecurity Fix(es):\r\n\r\nA memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.(CVE-2021-3905)","status":"published","published":"2022-07-26T11:05:03Z","modified":"2026-08-18T01:16:50.880987238Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHBA-2022:0051","title":"Red Hat Bug Fix Advisory: openvswitch2.13 update","status":"published","published":"2024-09-13T17:26:28Z","modified":"2026-06-29T10:38:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2022:0052","title":"Red Hat Bug Fix Advisory: openvswitch2.15 update","status":"published","published":"2024-09-13T17:26:20Z","modified":"2026-06-29T10:38:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2022:5792","title":"Red Hat Bug Fix Advisory: openvswitch2.16 bug fix and enhancement update","status":"published","published":"2024-09-13T17:26:45Z","modified":"2026-06-29T10:39:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2021-3905","description":"A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.","status":"withdrawn","published":"2021-11-08T00:00:00Z","modified":"2026-02-04T02:58:43.419466Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"}]}}