{"id":"CVE-2026-34956","aliases":["AZL-86781","DEBIAN-CVE-2026-34956","EUVD-2026-27345","GHSA-q5f5-xxh8-jx9h","OESA-2026-1871","OESA-2026-1872","OESA-2026-1960","OESA-2026-1961","OESA-2026-1962","OESA-2026-2063","SUSE-SU-2026:1306-1","SUSE-SU-2026:1439-1","SUSE-SU-2026:1440-1","SUSE-SU-2026:1482-1","SUSE-SU-2026:1871-1","SUSE-SU-2026:21250-1","SUSE-SU-2026:22068-1","SUSE-SU-2026:22145-1","SUSE-SU-2026:22152-1","UBUNTU-CVE-2026-34956","openSUSE-SU-2026:10534-1","openSUSE-SU-2026:20972-1"],"status":"published","title":"Openvswitch: open vswitch: denial of service via malformed ftp epasv command","description":"A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00405,"percentile":0.35222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2026-04-11T00:00:00Z","modified":"2026-11-05T21:18:47Z","fixes":[{"ecosystem":"Azure Linux:3","package":"openvswitch","fixed_in":["3.3.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openvswitch","fixed_in":["3.7.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"openvswitch","fixed_in":["2.12.4-9.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"openvswitch","fixed_in":["3.2.1-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"openvswitch","fixed_in":["3.2.1-5.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"openvswitch","fixed_in":["3.2.1-5.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"openvswitch","fixed_in":["3.2.1-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"openvswitch","fixed_in":["2.12.4-11.oe2003sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"openvswitch","fixed_in":["3.5.4-150700.41.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"openvswitch","fixed_in":["3.5.4-150700.41.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openvswitch3","fixed_in":["3.1.7-150500.3.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openvswitch","fixed_in":["2.11.5-3.30.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"openvswitch","fixed_in":["3.1.7-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"openvswitch","fixed_in":["3.1.7-slfo.1.1_3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openvswitch","fixed_in":["3.7.1-33.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-2","3.1.0-2+deb12u1","3.1.2-1","3.1.2-2","3.1.2-3","3.1.2-4","3.2.0-1","3.2.0-2","3.2.2~git20231029-1","3.2.2~git20231029-2","3.3.0-1","3.3.0-2","3.3.0-3","3.3.0-4","3.3.0-5","3.3.0~git20240118.e802fe7-1","3.3.0~git20240118.e802fe7-2","3.3.0~git20240118.e802fe7-3","3.3.1-1","3.4.0-1","3.5.0-1","3.5.0~git20241129.2af7cef-1","3.5.0~git20241129.2af7cef-2","3.6.0-1","3.6.0-2","3.6.0-3","3.6.0-5","3.6.0-6","3.6.0-7","3.7.0-1","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d1","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d2","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d3","3.7.1-1","3.7.1-2","3.7.1-3","4.0.0-1","4.0.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.0-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.0-5","3.6.0-6","3.6.0-7","3.7.0-1","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d1","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d2","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d3","3.7.1-1","3.7.1-2","3.7.1-3","4.0.0-1","4.0.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-1"}]}],"versions":["3.5.0-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.0-5","3.6.0-6","3.6.0-7","3.7.0-1","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d1","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d2","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d3"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.4-9.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-5.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-5.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.4-11.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150700.41.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150700.41.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openvswitch3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-150500.3.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5-3.30.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-slfo.1.1_3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.0-0ubuntu2","2.8.1-0ubuntu2","2.8.1-0ubuntu3","2.9.0~git20180205.5a39582ca-0ubuntu1","2.9.0-0ubuntu1","2.9.2-0ubuntu0.18.04.2","2.9.2-0ubuntu0.18.04.3","2.9.5-0ubuntu0.18.04.1","2.9.7-0ubuntu0.18.04.2","2.9.8-0ubuntu0.18.04.2","2.9.8-0ubuntu0.18.04.3","2.9.8-0ubuntu0.18.04.4","2.9.8-0ubuntu0.18.04.5","2.9.8-0ubuntu0.18.04.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.0-0ubuntu1","2.12.0-0ubuntu2","2.12.1~git20191107.7accd1302-0ubuntu1","2.12.90~git20200107.af683565b-0ubuntu1","2.12.90~git20200107.af683565b-0ubuntu2","2.12.90~git20200107.af683565b-0ubuntu3","2.13.0~git20200127.dbdf66c29-0ubuntu2","2.13.0~git20200212.15ae9db33-0ubuntu1","2.13.0~git20200212.15ae9db33-0ubuntu2","2.13.0-0ubuntu1","2.13.1-0ubuntu0.20.04.1","2.13.1-0ubuntu0.20.04.3","2.13.1-0ubuntu0.20.04.4","2.13.3-0ubuntu0.20.04.1","2.13.3-0ubuntu0.20.04.2","2.13.5-0ubuntu1","2.13.8-0ubuntu1","2.13.8-0ubuntu1.1","2.13.8-0ubuntu1.2","2.13.8-0ubuntu1.3","2.13.8-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.0-0ubuntu2","2.16.0-0ubuntu3","2.16.0-0ubuntu4","2.17.0~git20220105.0d1ffb7-0ubuntu1","2.17.0~git20220118.1b9fd88-0ubuntu1","2.17.0~git20220121.109d024-0ubuntu1","2.17.0-0ubuntu1","2.17.2-0ubuntu0.22.04.1","2.17.2-0ubuntu0.22.04.2","2.17.3-0ubuntu0.22.04.1","2.17.3-0ubuntu0.22.04.2","2.17.5-0ubuntu0.22.04.2","2.17.7-0ubuntu0.22.04.1","2.17.8-0ubuntu0.22.04.1","2.17.9-0ubuntu0.22.04.1","2.17.9-0ubuntu0.22.04.2","2.17.12-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.0-1","3.2.0-2","3.2.0-2build1","3.2.2~git20231029-2","3.2.2~git20231029-2build1","3.3.0~git20240118.e802fe7-2","3.3.0~git20240118.e802fe7-3","3.3.0-1","3.3.0-1build1","3.3.0-1ubuntu1","3.3.0-1ubuntu3","3.3.0-1ubuntu3.1","3.3.0-1ubuntu3.2","3.3.4-0ubuntu0.24.04.1","3.3.4-0ubuntu0.24.04.2","3.3.9-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.0-1build1","3.5.1-0ubuntu1","3.6.0-1","3.6.0-2","3.6.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.0-2","3.6.0-2build1","3.6.0-5","3.6.0-6","3.6.0-6build1","3.6.0-6ubuntu2","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d1","3.7.0-1","3.7.0-1build1","3.7.1-1","3.7.1-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-33.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-160000.4.1"}]}],"bundled":3}],"products":[{"vendor":"red hat","product":"fast datapath for rhel 7"},{"vendor":"red hat","product":"fast datapath for rhel 8"},{"vendor":"red hat","product":"fast datapath for rhel 9"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.1"},{"vendor":"red hat","product":"red hat openstack platform 18.0"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-34956","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453459","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/31/15"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34956","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q5f5-xxh8-jx9h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34956","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1871","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1872","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1960","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1961","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1962","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2063","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261306-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261273","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34956","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261439-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261440-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261482-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261871-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621250-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622068-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622145-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262498","tags":["report"]},{"url":"https://bugzilla.suse.com/1262499","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5367","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622152-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34956","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/03/31/15","tags":["report"]},{"url":"https://mail.openvswitch.org/pipermail/ovs-dev/2026-March/431425.html","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34956","title":"Openvswitch: open vswitch: denial of service via malformed ftp epasv command","description":"A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.","status":"published","published":"2026-05-05T15:45:04.638Z","modified":"2026-11-05T20:31:54.747Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-05T21:25:06.152449Z"}],"euvd":[{"id":"EUVD-2026-27345","description":"A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.","status":"published","published":"2026-05-05T15:45:04Z","modified":"2026-11-05T20:31:54Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T22:02:11.350454Z"}],"ghsa":[{"id":"GHSA-q5f5-xxh8-jx9h","title":"A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP...","description":"A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.","status":"published","published":"2026-05-05T18:33:24Z","modified":"2026-05-05T18:33:25Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:07:54.707151Z"}],"nvd":[{"id":"CVE-2026-34956","description":"A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.","status":"published","published":"2026-05-05T16:16:11.927Z","modified":"2026-11-05T21:18:47.47Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-05T23:57:17.922269Z"}],"osv":[{"id":"DEBIAN-CVE-2026-34956","description":"A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.","status":"published","published":"2026-05-05T16:16:11.927Z","modified":"2026-10-27T09:47:42.919537685Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"OESA-2026-1871","title":"openvswitch security update","description":"Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.\r\n\r\nSecurity Fix(es):\n\n[\u0026quot;Description\\n===========\\n\\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\\ncausing invalid memory accesses, potential denial of service, and possible\\nremote code execution.  This impacts the userspace implementation of\\nconntrack.  Triggering the vulnerability requires that Open vSwitch has\\nconfigured conntrack flows specifying the FTP alg handler.  Conntrack\\nhandlers in userspace are not automatically applied.\\n\\nThe issue is caused by type narrowing when copying FTP substrings.  It\\nhas existed in all versions of the userspace conntrack supporting the\\nFTP handler.  This was introduced with Open vSwitch version 2.8.0 and\\naffects all versions up to 3.7.0.\\n\\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\\nassigned CVE-2026-34956 identifier to this issue.  At the time of writing\\nthe flaw is considered with Moderate impact and 5.9 CVSS.\\n\\n\\nMitigation\\n==========\\n\\nFor any affected version of Open vSwitch, avoiding the FTP alg will\\nprevent the issue from triggering.  The Open vSwitch team does not\\nrecommend attempting to mitigate the vulnerability this way because it\\nmay impact packet forwarding.\\n\\nBy default, alg handlers are not installed, and must be added as part\\nof the OpenFlow rules (via \u0026apos;ct(alg=ftp)\u0026apos; for example).\\n\\nUsers can check if they are using affected flows by looking at their\\nOpenFlow ruleset for their bridges, for example:\\n\\n   ovs-ofctl dump-flows \u0026lt;bridge\u0026gt; | grep \u0026apos;alg=ftp\u0026apos;\\n\\nWe have found that Open vSwitch may be subject to heap corruption when\\nprocessing FTP messages.\\n\\n\\nFix\\n===\\n\\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\\napplied to the appropriate branches, and the original patch is located\\nat:\u0026quot;, \u0026apos;Recommendation\\n==============\\n\\nWe recommend that users of Open vSwitch apply the included patch, or\\nupgrade to a known patched version of Open vSwitch.  These include:\\n\\n* 3.3.9\\n* 3.4.6\\n* 3.5.4\\n* 3.6.3\\n* 3.7.1\\n\\n\\nAcknowledgements\\n================\\n\\nThe Open vSwitch team wishes to thank the reporter:\\n\\n  * Seiji Sakurai \u0026lt;Seiji.Sakurai () outlook com\u0026gt;\u0026apos;](CVE-2026-34956)","status":"published","published":"2026-04-11T11:10:53Z","modified":"2026-08-18T01:19:46.945572403Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1872","title":"openvswitch security update","description":"Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.\r\n\r\nSecurity Fix(es):\n\n[\u0026quot;Description\\n===========\\n\\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\\ncausing invalid memory accesses, potential denial of service, and possible\\nremote code execution.  This impacts the userspace implementation of\\nconntrack.  Triggering the vulnerability requires that Open vSwitch has\\nconfigured conntrack flows specifying the FTP alg handler.  Conntrack\\nhandlers in userspace are not automatically applied.\\n\\nThe issue is caused by type narrowing when copying FTP substrings.  It\\nhas existed in all versions of the userspace conntrack supporting the\\nFTP handler.  This was introduced with Open vSwitch version 2.8.0 and\\naffects all versions up to 3.7.0.\\n\\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\\nassigned CVE-2026-34956 identifier to this issue.  At the time of writing\\nthe flaw is considered with Moderate impact and 5.9 CVSS.\\n\\n\\nMitigation\\n==========\\n\\nFor any affected version of Open vSwitch, avoiding the FTP alg will\\nprevent the issue from triggering.  The Open vSwitch team does not\\nrecommend attempting to mitigate the vulnerability this way because it\\nmay impact packet forwarding.\\n\\nBy default, alg handlers are not installed, and must be added as part\\nof the OpenFlow rules (via \u0026apos;ct(alg=ftp)\u0026apos; for example).\\n\\nUsers can check if they are using affected flows by looking at their\\nOpenFlow ruleset for their bridges, for example:\\n\\n   ovs-ofctl dump-flows \u0026lt;bridge\u0026gt; | grep \u0026apos;alg=ftp\u0026apos;\\n\\nWe have found that Open vSwitch may be subject to heap corruption when\\nprocessing FTP messages.\\n\\n\\nFix\\n===\\n\\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\\napplied to the appropriate branches, and the original patch is located\\nat:\u0026quot;, \u0026apos;Recommendation\\n==============\\n\\nWe recommend that users of Open vSwitch apply the included patch, or\\nupgrade to a known patched version of Open vSwitch.  These include:\\n\\n* 3.3.9\\n* 3.4.6\\n* 3.5.4\\n* 3.6.3\\n* 3.7.1\\n\\n\\nAcknowledgements\\n================\\n\\nThe Open vSwitch team wishes to thank the reporter:\\n\\n  * Seiji Sakurai \u0026lt;Seiji.Sakurai () outlook com\u0026gt;\u0026apos;](CVE-2026-34956)","status":"published","published":"2026-04-11T11:10:53Z","modified":"2026-08-18T01:19:47.076622537Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1960","title":"openvswitch security update","description":"Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.\r\n\r\nSecurity Fix(es):\n\n[\u0026quot;Description\\n===========\\n\\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\\ncausing invalid memory accesses, potential denial of service, and possible\\nremote code execution.  This impacts the userspace implementation of\\nconntrack.  Triggering the vulnerability requires that Open vSwitch has\\nconfigured conntrack flows specifying the FTP alg handler.  Conntrack\\nhandlers in userspace are not automatically applied.\\n\\nThe issue is caused by type narrowing when copying FTP substrings.  It\\nhas existed in all versions of the userspace conntrack supporting the\\nFTP handler.  This was introduced with Open vSwitch version 2.8.0 and\\naffects all versions up to 3.7.0.\\n\\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\\nassigned CVE-2026-34956 identifier to this issue.  At the time of writing\\nthe flaw is considered with Moderate impact and 5.9 CVSS.\\n\\n\\nMitigation\\n==========\\n\\nFor any affected version of Open vSwitch, avoiding the FTP alg will\\nprevent the issue from triggering.  The Open vSwitch team does not\\nrecommend attempting to mitigate the vulnerability this way because it\\nmay impact packet forwarding.\\n\\nBy default, alg handlers are not installed, and must be added as part\\nof the OpenFlow rules (via \u0026apos;ct(alg=ftp)\u0026apos; for example).\\n\\nUsers can check if they are using affected flows by looking at their\\nOpenFlow ruleset for their bridges, for example:\\n\\n   ovs-ofctl dump-flows \u0026lt;bridge\u0026gt; | grep \u0026apos;alg=ftp\u0026apos;\\n\\nWe have found that Open vSwitch may be subject to heap corruption when\\nprocessing FTP messages.\\n\\n\\nFix\\n===\\n\\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\\napplied to the appropriate branches, and the original patch is located\\nat:\u0026quot;, \u0026apos;Recommendation\\n==============\\n\\nWe recommend that users of Open vSwitch apply the included patch, or\\nupgrade to a known patched version of Open vSwitch.  These include:\\n\\n* 3.3.9\\n* 3.4.6\\n* 3.5.4\\n* 3.6.3\\n* 3.7.1\\n\\n\\nAcknowledgements\\n================\\n\\nThe Open vSwitch team wishes to thank the reporter:\\n\\n  * Seiji Sakurai \u0026lt;Seiji.Sakurai () outlook com\u0026gt;\u0026apos;](CVE-2026-34956)","status":"published","published":"2026-04-17T11:10:58Z","modified":"2026-08-18T01:19:39.23330595Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1961","title":"openvswitch security update","description":"Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.\r\n\r\nSecurity Fix(es):\n\n[\u0026quot;Description\\n===========\\n\\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\\ncausing invalid memory accesses, potential denial of service, and possible\\nremote code execution.  This impacts the userspace implementation of\\nconntrack.  Triggering the vulnerability requires that Open vSwitch has\\nconfigured conntrack flows specifying the FTP alg handler.  Conntrack\\nhandlers in userspace are not automatically applied.\\n\\nThe issue is caused by type narrowing when copying FTP substrings.  It\\nhas existed in all versions of the userspace conntrack supporting the\\nFTP handler.  This was introduced with Open vSwitch version 2.8.0 and\\naffects all versions up to 3.7.0.\\n\\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\\nassigned CVE-2026-34956 identifier to this issue.  At the time of writing\\nthe flaw is considered with Moderate impact and 5.9 CVSS.\\n\\n\\nMitigation\\n==========\\n\\nFor any affected version of Open vSwitch, avoiding the FTP alg will\\nprevent the issue from triggering.  The Open vSwitch team does not\\nrecommend attempting to mitigate the vulnerability this way because it\\nmay impact packet forwarding.\\n\\nBy default, alg handlers are not installed, and must be added as part\\nof the OpenFlow rules (via \u0026apos;ct(alg=ftp)\u0026apos; for example).\\n\\nUsers can check if they are using affected flows by looking at their\\nOpenFlow ruleset for their bridges, for example:\\n\\n   ovs-ofctl dump-flows \u0026lt;bridge\u0026gt; | grep \u0026apos;alg=ftp\u0026apos;\\n\\nWe have found that Open vSwitch may be subject to heap corruption when\\nprocessing FTP messages.\\n\\n\\nFix\\n===\\n\\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\\napplied to the appropriate branches, and the original patch is located\\nat:\u0026quot;, \u0026apos;Recommendation\\n==============\\n\\nWe recommend that users of Open vSwitch apply the included patch, or\\nupgrade to a known patched version of Open vSwitch.  These include:\\n\\n* 3.3.9\\n* 3.4.6\\n* 3.5.4\\n* 3.6.3\\n* 3.7.1\\n\\n\\nAcknowledgements\\n================\\n\\nThe Open vSwitch team wishes to thank the reporter:\\n\\n  * Seiji Sakurai \u0026lt;Seiji.Sakurai () outlook com\u0026gt;\u0026apos;](CVE-2026-34956)","status":"published","published":"2026-04-17T11:10:58Z","modified":"2026-08-18T01:19:48.071920379Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1962","title":"openvswitch security update","description":"Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.\r\n\r\nSecurity Fix(es):\n\n[\u0026quot;Description\\n===========\\n\\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\\ncausing invalid memory accesses, potential denial of service, and possible\\nremote code execution.  This impacts the userspace implementation of\\nconntrack.  Triggering the vulnerability requires that Open vSwitch has\\nconfigured conntrack flows specifying the FTP alg handler.  Conntrack\\nhandlers in userspace are not automatically applied.\\n\\nThe issue is caused by type narrowing when copying FTP substrings.  It\\nhas existed in all versions of the userspace conntrack supporting the\\nFTP handler.  This was introduced with Open vSwitch version 2.8.0 and\\naffects all versions up to 3.7.0.\\n\\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\\nassigned CVE-2026-34956 identifier to this issue.  At the time of writing\\nthe flaw is considered with Moderate impact and 5.9 CVSS.\\n\\n\\nMitigation\\n==========\\n\\nFor any affected version of Open vSwitch, avoiding the FTP alg will\\nprevent the issue from triggering.  The Open vSwitch team does not\\nrecommend attempting to mitigate the vulnerability this way because it\\nmay impact packet forwarding.\\n\\nBy default, alg handlers are not installed, and must be added as part\\nof the OpenFlow rules (via \u0026apos;ct(alg=ftp)\u0026apos; for example).\\n\\nUsers can check if they are using affected flows by looking at their\\nOpenFlow ruleset for their bridges, for example:\\n\\n   ovs-ofctl dump-flows \u0026lt;bridge\u0026gt; | grep \u0026apos;alg=ftp\u0026apos;\\n\\nWe have found that Open vSwitch may be subject to heap corruption when\\nprocessing FTP messages.\\n\\n\\nFix\\n===\\n\\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\\napplied to the appropriate branches, and the original patch is located\\nat:\u0026quot;, \u0026apos;Recommendation\\n==============\\n\\nWe recommend that users of Open vSwitch apply the included patch, or\\nupgrade to a known patched version of Open vSwitch.  These include:\\n\\n* 3.3.9\\n* 3.4.6\\n* 3.5.4\\n* 3.6.3\\n* 3.7.1\\n\\n\\nAcknowledgements\\n================\\n\\nThe Open vSwitch team wishes to thank the reporter:\\n\\n  * Seiji Sakurai \u0026lt;Seiji.Sakurai () outlook com\u0026gt;\u0026apos;](CVE-2026-34956)","status":"published","published":"2026-04-17T11:10:58Z","modified":"2026-08-18T01:19:48.022398996Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-2063","title":"openvswitch security update","description":"Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.\r\n\r\nSecurity Fix(es):\n\n[\u0026quot;Description\\n===========\\n\\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\\ncausing invalid memory accesses, potential denial of service, and possible\\nremote code execution.  This impacts the userspace implementation of\\nconntrack.  Triggering the vulnerability requires that Open vSwitch has\\nconfigured conntrack flows specifying the FTP alg handler.  Conntrack\\nhandlers in userspace are not automatically applied.\\n\\nThe issue is caused by type narrowing when copying FTP substrings.  It\\nhas existed in all versions of the userspace conntrack supporting the\\nFTP handler.  This was introduced with Open vSwitch version 2.8.0 and\\naffects all versions up to 3.7.0.\\n\\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\\nassigned CVE-2026-34956 identifier to this issue.  At the time of writing\\nthe flaw is considered with Moderate impact and 5.9 CVSS.\\n\\n\\nMitigation\\n==========\\n\\nFor any affected version of Open vSwitch, avoiding the FTP alg will\\nprevent the issue from triggering.  The Open vSwitch team does not\\nrecommend attempting to mitigate the vulnerability this way because it\\nmay impact packet forwarding.\\n\\nBy default, alg handlers are not installed, and must be added as part\\nof the OpenFlow rules (via \u0026apos;ct(alg=ftp)\u0026apos; for example).\\n\\nUsers can check if they are using affected flows by looking at their\\nOpenFlow ruleset for their bridges, for example:\\n\\n   ovs-ofctl dump-flows \u0026lt;bridge\u0026gt; | grep \u0026apos;alg=ftp\u0026apos;\\n\\nWe have found that Open vSwitch may be subject to heap corruption when\\nprocessing FTP messages.\\n\\n\\nFix\\n===\\n\\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\\napplied to the appropriate branches, and the original patch is located\\nat:\u0026quot;, \u0026apos;Recommendation\\n==============\\n\\nWe recommend that users of Open vSwitch apply the included patch, or\\nupgrade to a known patched version of Open vSwitch.  These include:\\n\\n* 3.3.9\\n* 3.4.6\\n* 3.5.4\\n* 3.6.3\\n* 3.7.1\\n\\n\\nAcknowledgements\\n================\\n\\nThe Open vSwitch team wishes to thank the reporter:\\n\\n  * Seiji Sakurai \u0026lt;Seiji.Sakurai () outlook com\u0026gt;\u0026apos;](CVE-2026-34956)","status":"published","published":"2026-04-25T11:11:03Z","modified":"2026-08-18T01:19:49.449203228Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"UBUNTU-CVE-2026-34956","description":"A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.","status":"published","published":"2026-05-05T16:16:00Z","modified":"2026-08-13T07:45:12.009739888Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-86781","title":"CVE-2026-34956 affecting package openvswitch for versions less than 3.3.0-3","description":"A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.","status":"published","published":"2026-05-05T16:16:11Z","modified":"2026-08-28T17:56:48.174853Z","updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"openSUSE-SU-2026:10534-1","title":"libopenvswitch-3_7-0-3.7.1-33.1 on GA media","description":"These are all security issues fixed in the libopenvswitch-3_7-0-3.7.1-33.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-11T00:00:00Z","modified":"2026-04-12T10:18:35.238136Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20972-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n\nChanges for openvswitch:\n\n- Update ovn to 25.03.3\n - Bug fixes\n - Add support for special port_security prefix \"VRRPv3\". This prefix allows\n CMS to allow all required traffic for a VRRPv3 virtual router behind LSP.\n See ovn-nb(5) man page for more details.\n - Fixed support for fragmented traffic in the userspace datapath. Added the\n \"acl_ct_translation\" NB_Global option to enable connection tracking\n based L4 field translation for stateful ACLs. When enabled allows proper\n handling of IP fragmentation in userspace datapaths. This option may break\n hardware offloading and is disabled by default.\n - Added disable_garp_rarp option to logical_router table in order to disable\n GARP/RARP announcements by all the peer ports of this logical router.\n- Update openvswitch to 3.5.4\n - Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt\n - OVS validated with DPDK 24.11.4.\n - Fixed buffer overflow during conntrack processing of alg=ftp in\n userspace datapath (CVE-2026-34956) (bsc#1261273).\n- Update openvswitch to 3.5.3\n * Full changelog https://www.openvswitch.org/releases/NEWS-3.5.3.txt\n * Bug fixes\n","status":"published","published":"2026-06-17T08:37:36Z","modified":"2026-06-24T18:24:20.766456786Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:1306-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues:\n\n- CVE-2026-34956: invalid memory access via crafted FTP payloads in userspace conntrack flows specifying the FTP alg\n  handler (bsc#1261273).\n","status":"withdrawn","published":"2026-04-13T20:02:52Z","modified":"2026-07-13T14:00:33.945787668Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1439-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issue:\n\nSecurity updates:\n\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n\nOther updates:\n\n- Update openvswitch to 3.5.4\n","status":"published","published":"2026-04-17T13:43:31Z","modified":"2026-04-18T08:00:59.096865Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1440-1","title":"Security update for openvswitch3","description":"This update for openvswitch3 fixes the following issues:\n\n- CVE-2026-34956: invalid memory access via crafted FTP payloads in userspace conntrack flows specifying the FTP alg\n  handler (bsc#1261273).\n","status":"published","published":"2026-04-17T13:44:06Z","modified":"2026-04-18T08:00:15.725554Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1482-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues:\n\n- CVE-2026-34956: invalid memory access via crafted FTP payloads in userspace conntrack flows specifying the FTP alg\n  handler (bsc#1261273).\n","status":"published","published":"2026-04-20T10:10:03Z","modified":"2026-04-21T08:16:29.709037Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1871-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issue:\n\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n","status":"withdrawn","published":"2026-05-15T15:22:08Z","modified":"2026-07-13T14:00:33.863410613Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21250-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issue:\n\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n","status":"published","published":"2026-04-21T09:05:08Z","modified":"2026-04-24T18:25:01.665548Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22068-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issue\n\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n","status":"published","published":"2026-06-04T12:10:36Z","modified":"2026-06-13T18:24:17.974486102Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22145-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n\nChanges for openvswitch:\n\n- Update ovn to 25.03.3\n - Bug fixes\n - Add support for special port_security prefix \"VRRPv3\". This prefix allows\n CMS to allow all required traffic for a VRRPv3 virtual router behind LSP.\n See ovn-nb(5) man page for more details.\n - Fixed support for fragmented traffic in the userspace datapath. Added the\n \"acl_ct_translation\" NB_Global option to enable connection tracking\n based L4 field translation for stateful ACLs. When enabled allows proper\n handling of IP fragmentation in userspace datapaths. This option may break\n hardware offloading and is disabled by default.\n - Added disable_garp_rarp option to logical_router table in order to disable\n GARP/RARP announcements by all the peer ports of this logical router.\n- Update openvswitch to 3.5.4\n - Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt\n - OVS validated with DPDK 24.11.4.\n - Fixed buffer overflow during conntrack processing of alg=ftp in\n userspace datapath (CVE-2026-34956) (bsc#1261273).\n- Update openvswitch to 3.5.3\n * Full changelog https://www.openvswitch.org/releases/NEWS-3.5.3.txt\n * Bug fixes\n","status":"published","published":"2026-06-17T08:36:56Z","modified":"2026-06-19T18:24:08.456064003Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22152-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n\nChanges for openvswitch:\n\n- Update ovn to 25.03.3\n - Bug fixes\n - Add support for special port_security prefix \"VRRPv3\". This prefix allows\n CMS to allow all required traffic for a VRRPv3 virtual router behind LSP.\n See ovn-nb(5) man page for more details.\n - Fixed support for fragmented traffic in the userspace datapath. Added the\n \"acl_ct_translation\" NB_Global option to enable connection tracking\n based L4 field translation for stateful ACLs. When enabled allows proper\n handling of IP fragmentation in userspace datapaths. This option may break\n hardware offloading and is disabled by default.\n - Added disable_garp_rarp option to logical_router table in order to disable\n GARP/RARP announcements by all the peer ports of this logical router.\n- Update openvswitch to 3.5.4\n - Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt\n - OVS validated with DPDK 24.11.4.\n - Fixed buffer overflow during conntrack processing of alg=ftp in\n userspace datapath (CVE-2026-34956) (bsc#1261273).\n- Update openvswitch to 3.5.3\n * Full changelog https://www.openvswitch.org/releases/NEWS-3.5.3.txt\n * Bug fixes\n","status":"published","published":"2026-06-17T08:36:56Z","modified":"2026-06-24T18:24:22.559997384Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}