{"id":"CVE-2026-5265","aliases":["DEBIAN-CVE-2026-5265","EUVD-2026-25420","GHSA-whr7-6788-jg2p","RHSA-2026:11694","RHSA-2026:11695","RHSA-2026:11696","RHSA-2026:11698","RHSA-2026:11700","RHSA-2026:11701","RHSA-2026:11702","RHSA-2026:22110","RHSA-2026:22111","SUSE-SU-2026:22105-1","SUSE-SU-2026:22145-1","SUSE-SU-2026:22152-1","SUSE-SU-2026:23188-1","SUSE-SU-2026:2463-1","SUSE-SU-2026:2475-1","SUSE-SU-2026:2476-1","SUSE-SU-2026:2481-1","UBUNTU-CVE-2026-5265","openSUSE-SU-2026:10956-1","openSUSE-SU-2026:20972-1"],"status":"published","title":"Ovn: ovn: heap over-read in icmp error response generation","description":"When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00629,"percentile":0.5045,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-130"],"published":"2026-04-20T00:00:00Z","modified":"2026-10-27T09:47:32Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"ovn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.03.0-1","23.03.0-2","23.03.0-3","23.03.1-1~deb12u1","23.03.1-1~deb12u2","23.09.0-1","23.09.0-2","24.03.0-1","24.03.0~git20240205.ebb7076-1","24.03.1-1","24.03.1-2","24.03.2-1","24.03.2-2","24.09.0-1","25.03.0-1","25.03.0~git20250216.7c69af7-1","25.03.0~git20250216.7c69af7-2","25.09.0-1","25.09.0-2","25.09.0-3","26.03.0-1","26.03.0-2","26.03.0-3","26.03.0-4","26.03.0-5","26.03.0-6","26.03.0~git20260216.b543a88-1","26.03.0~git20260216.b543a88-2","26.03.0~git20260216.b543a88-3","26.03.0~git20260216.b543a88-4","26.03.1-1","26.03.2-1","26.09.0-1","26.09.0~git20260819.c60a7af-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ovn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.03.0-1","25.09.0-1","25.09.0-2","25.09.0-3","26.03.0-1","26.03.0-2","26.03.0-3","26.03.0-4","26.03.0-5","26.03.0-6","26.03.0~git20260216.b543a88-1","26.03.0~git20260216.b543a88-2","26.03.0~git20260216.b543a88-3","26.03.0~git20260216.b543a88-4","26.03.1-1","26.03.2-1","26.09.0-1","26.09.0~git20260819.c60a7af-1"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn-2021","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.12.0-145.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn-2021-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.12.0-145.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn-2021-central-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.12.0-145.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn-2021-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.12.0-145.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn-2021-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.12.0-145.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn-2021-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.12.0-145.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn-2021-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.12.0-145.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn-2021-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.12.0-145.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn-2021-vtep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:21.12.0-145.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn23.06","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn23.06-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn23.06-central-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn23.06-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn23.06-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn23.06-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn23.06-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn23.06-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::fastdatapath","package":"ovn23.06-vtep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el8fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.06","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.06-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.06-central-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.06-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.06-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.06-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.06-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.06-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.06-vtep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.06.4-30.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.09","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.09.6-16.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.09-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.09.6-16.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.09-central-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.09.6-16.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.09-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.09.6-16.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.09-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.09.6-16.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.09-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.09.6-16.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.09-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.09.6-16.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.09-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.09.6-16.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn23.09-vtep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:23.09.6-16.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn24.03","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.03.7-82.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn24.03-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.03.7-82.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn24.03-central-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.03.7-82.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn24.03-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.03.7-82.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn24.03-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.03.7-82.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn24.03-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.03.7-82.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn24.03-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.03.7-82.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn24.03-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.03.7-82.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn24.03-vtep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.03.7-82.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.03","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.03-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.03-central-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.03-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.03-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.03-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.03-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.03-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.03-vtep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.09","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.09-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.09-central-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.09-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.09-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.09-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.09-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.09-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::fastdatapath","package":"ovn25.09-vtep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el9fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.03","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.03-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.03-central-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.03-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.03-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.03-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.03-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.03-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.03-vtep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.03.2-100.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.09","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.09-central","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.09-central-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.09-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.09-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.09-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.09-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.09-vtep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10::fastdatapath","package":"ovn25.09-vtep-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.09.2-103.el10fdp"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-160000.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-slfo.1.1_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150700.41.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-150700.41.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-150600.33.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-150600.33.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"openvswitch3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-150500.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"openvswitch3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-150500.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"openvswitch3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-150500.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openvswitch3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-150500.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openvswitch3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7-150500.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2-150400.24.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2-150400.24.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2-150400.24.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2-150400.24.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2-150400.24.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.2-150400.24.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ovn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.90~git20200107.c80e014d4-0ubuntu1","2.12.90~git20200107.c80e014d4-0ubuntu2","20.03.0~git20200212.9a4e68ec8-0ubuntu1","20.03.0~git20200212.9a4e68ec8-0ubuntu3","20.03.0-0ubuntu1","20.03.1-0ubuntu1","20.03.1-0ubuntu1.1","20.03.1-0ubuntu1.2","20.03.2-0ubuntu0.20.04.1","20.03.2-0ubuntu0.20.04.2","20.03.2-0ubuntu0.20.04.3","20.03.2-0ubuntu0.20.04.4","20.03.2-0ubuntu0.20.04.5","20.03.2-0ubuntu0.20.04.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ovn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["21.09.0~git20210922.6549e5842-0ubuntu1","21.09.0~git20210922.6549e5842-0ubuntu2","21.09.0-0ubuntu2","21.12.0-0ubuntu1","22.03.0~git20220218.ed81be7-0ubuntu1","22.03.0-0ubuntu1","22.03.2-0ubuntu0.22.04.1","22.03.3-0ubuntu0.22.04.1","22.03.3-0ubuntu0.22.04.2","22.03.3-0ubuntu0.22.04.3","22.03.3-0ubuntu0.22.04.5","22.03.8-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ovn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.09.0-1","23.09.0-2","24.03.0~git20240205.ebb7076-1","24.03.1-2ubuntu1","24.03.1-2ubuntu3","24.03.2-0ubuntu0.24.04.1","24.03.2-0ubuntu0.24.04.2","24.03.6-0ubuntu0.24.04.1","24.03.8-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ovn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.03.0-1","25.09.0~git20250813.23884f5-maysync1","25.09.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ovn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["26.03.0-2","26.03.0-6","26.03.1-1","26.09.0~git20260819.c60a7af-1","26.09.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ovn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.09.0-1","25.09.0-3","26.03.0~git20260216.b543a88-2","26.03.0-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.4-160000.4.1"}]}],"bundled":3}],"products":[{"vendor":"red hat","product":"fast datapath for red hat enterprise linux 10"},{"vendor":"red hat","product":"fast datapath for red hat enterprise linux 8"},{"vendor":"red hat","product":"fast datapath for red hat enterprise linux 9"},{"vendor":"red hat","product":"fast datapath for rhel 7"},{"vendor":"red hat","product":"fast datapath for rhel 8"},{"vendor":"red hat","product":"fast datapath for rhel 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:11694","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11695","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11696","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11698","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11700","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11701","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11702","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22110","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22111","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5265","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453458","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/20/2"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/20/4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5265","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-whr7-6788-jg2p"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5265","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455863","tags":["report"]},{"url":"https://issues.redhat.com/browse/FDP-3691","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11694.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5265","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5367","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5367","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/FDP-3692","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11695.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/FDP-3693","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11696.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/FDP-3739","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11698.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/FDP-3265","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3490","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3497","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3695","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11700.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/FDP-3262","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3487","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3499","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3540","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3696","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11701.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/FDP-3258","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3259","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3485","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3501","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3538","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3602","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3698","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11702.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/FDP-3263","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3488","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3500","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3541","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3697","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22110.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/FDP-3260","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3261","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3486","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3502","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3539","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3603","tags":["article"]},{"url":"https://issues.redhat.com/browse/FDP-3699","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22111.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622105-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262498","tags":["report"]},{"url":"https://bugzilla.suse.com/1262499","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5367","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622145-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261273","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34956","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622152-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623188-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0650","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262463-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262475-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262476-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262481-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-5265","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-5265","title":"Ovn: ovn: heap over-read in icmp error response generation","description":"When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.","status":"published","published":"2026-04-24T12:25:06.808Z","modified":"2026-06-17T22:00:07.95Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T13:39:27.849196Z"}],"euvd":[{"id":"EUVD-2026-25420","description":"When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.","status":"published","published":"2026-04-24T12:25:06Z","modified":"2026-06-17T22:00:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:37.444507Z"}],"ghsa":[{"id":"GHSA-whr7-6788-jg2p","title":"When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a...","description":"When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.","status":"published","published":"2026-04-24T15:32:32Z","modified":"2026-06-01T06:30:25Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T15:08:25.52807Z"}],"nvd":[{"id":"CVE-2026-5265","description":"When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.","status":"published","published":"2026-04-24T13:16:21.77Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-130"],"updated_at":"2026-11-02T14:12:15.867234Z"}],"osv":[{"id":"DEBIAN-CVE-2026-5265","description":"When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.","status":"published","published":"2026-04-24T13:16:21.77Z","modified":"2026-10-27T09:47:32.117812116Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"RHSA-2026:11694","title":"Red Hat Security Advisory: ovn-2021 security update","status":"published","published":"2026-04-30T10:10:44Z","modified":"2026-07-01T10:10:51Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:11695","title":"Red Hat Security Advisory: ovn23.06 security update","status":"published","published":"2026-04-30T10:10:45Z","modified":"2026-07-01T10:10:52Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:11696","title":"Red Hat Security Advisory: ovn23.06 security update","status":"published","published":"2026-04-30T10:10:45Z","modified":"2026-07-01T10:10:53Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:11698","title":"Red Hat Security Advisory: ovn23.09 security update","status":"published","published":"2026-04-30T10:10:46Z","modified":"2026-07-01T10:10:53Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:11700","title":"Red Hat Security Advisory: ovn24.03 security update","status":"published","published":"2026-04-30T10:10:46Z","modified":"2026-07-01T10:10:54Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:11701","title":"Red Hat Security Advisory: ovn25.03 security update","status":"published","published":"2026-04-30T10:10:47Z","modified":"2026-07-01T10:10:55Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:11702","title":"Red Hat Security Advisory: ovn25.09 security update","status":"published","published":"2026-04-30T10:10:48Z","modified":"2026-07-01T10:10:55Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:22110","title":"Red Hat Security Advisory: ovn25.03 security update","status":"published","published":"2026-06-01T10:04:32Z","modified":"2026-07-01T10:15:07Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:22111","title":"Red Hat Security Advisory: ovn25.09 security update","status":"published","published":"2026-06-01T10:04:32Z","modified":"2026-07-01T10:15:08Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"UBUNTU-CVE-2026-5265","description":"When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.","status":"published","published":"2026-04-20T00:00:00Z","modified":"2026-10-17T12:58:33.766129099Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"openSUSE-SU-2026:10956-1","title":"libopenvswitch-3_7-0-3.7.1-34.1 on GA media","description":"These are all security issues fixed in the libopenvswitch-3_7-0-3.7.1-34.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-04T00:00:00Z","modified":"2026-06-05T10:45:57.957470048Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20972-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n\nChanges for openvswitch:\n\n- Update ovn to 25.03.3\n - Bug fixes\n - Add support for special port_security prefix \"VRRPv3\". This prefix allows\n CMS to allow all required traffic for a VRRPv3 virtual router behind LSP.\n See ovn-nb(5) man page for more details.\n - Fixed support for fragmented traffic in the userspace datapath. Added the\n \"acl_ct_translation\" NB_Global option to enable connection tracking\n based L4 field translation for stateful ACLs. When enabled allows proper\n handling of IP fragmentation in userspace datapaths. This option may break\n hardware offloading and is disabled by default.\n - Added disable_garp_rarp option to logical_router table in order to disable\n GARP/RARP announcements by all the peer ports of this logical router.\n- Update openvswitch to 3.5.4\n - Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt\n - OVS validated with DPDK 24.11.4.\n - Fixed buffer overflow during conntrack processing of alg=ftp in\n userspace datapath (CVE-2026-34956) (bsc#1261273).\n- Update openvswitch to 3.5.3\n * Full changelog https://www.openvswitch.org/releases/NEWS-3.5.3.txt\n * Bug fixes\n","status":"published","published":"2026-06-17T08:37:36Z","modified":"2026-06-24T18:24:20.766456786Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22105-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n","status":"published","published":"2026-06-15T09:27:13Z","modified":"2026-06-17T18:24:12.480025731Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22145-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n\nChanges for openvswitch:\n\n- Update ovn to 25.03.3\n - Bug fixes\n - Add support for special port_security prefix \"VRRPv3\". This prefix allows\n CMS to allow all required traffic for a VRRPv3 virtual router behind LSP.\n See ovn-nb(5) man page for more details.\n - Fixed support for fragmented traffic in the userspace datapath. Added the\n \"acl_ct_translation\" NB_Global option to enable connection tracking\n based L4 field translation for stateful ACLs. When enabled allows proper\n handling of IP fragmentation in userspace datapaths. This option may break\n hardware offloading and is disabled by default.\n - Added disable_garp_rarp option to logical_router table in order to disable\n GARP/RARP announcements by all the peer ports of this logical router.\n- Update openvswitch to 3.5.4\n - Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt\n - OVS validated with DPDK 24.11.4.\n - Fixed buffer overflow during conntrack processing of alg=ftp in\n userspace datapath (CVE-2026-34956) (bsc#1261273).\n- Update openvswitch to 3.5.3\n * Full changelog https://www.openvswitch.org/releases/NEWS-3.5.3.txt\n * Bug fixes\n","status":"published","published":"2026-06-17T08:36:56Z","modified":"2026-06-19T18:24:08.456064003Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:22152-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).\n\nChanges for openvswitch:\n\n- Update ovn to 25.03.3\n - Bug fixes\n - Add support for special port_security prefix \"VRRPv3\". This prefix allows\n CMS to allow all required traffic for a VRRPv3 virtual router behind LSP.\n See ovn-nb(5) man page for more details.\n - Fixed support for fragmented traffic in the userspace datapath. Added the\n \"acl_ct_translation\" NB_Global option to enable connection tracking\n based L4 field translation for stateful ACLs. When enabled allows proper\n handling of IP fragmentation in userspace datapaths. This option may break\n hardware offloading and is disabled by default.\n - Added disable_garp_rarp option to logical_router table in order to disable\n GARP/RARP announcements by all the peer ports of this logical router.\n- Update openvswitch to 3.5.4\n - Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt\n - OVS validated with DPDK 24.11.4.\n - Fixed buffer overflow during conntrack processing of alg=ftp in\n userspace datapath (CVE-2026-34956) (bsc#1261273).\n- Update openvswitch to 3.5.3\n * Full changelog https://www.openvswitch.org/releases/NEWS-3.5.3.txt\n * Bug fixes\n","status":"published","published":"2026-06-17T08:36:56Z","modified":"2026-06-24T18:24:22.559997384Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:23188-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues:\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n","status":"published","published":"2026-08-17T16:50:12Z","modified":"2026-08-26T18:23:31.188916145Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:2463-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\nUpdate ovn to 25.03.3:\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n","status":"published","published":"2026-06-19T09:44:07Z","modified":"2026-06-20T08:45:05.294039076Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2475-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n","status":"published","published":"2026-06-22T08:23:52Z","modified":"2026-06-24T09:00:09.516234374Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2476-1","title":"Security update for openvswitch3","description":"This update for openvswitch3 fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n","status":"published","published":"2026-06-22T08:24:23Z","modified":"2026-06-24T09:00:09.500711722Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2481-1","title":"Security update for openvswitch","description":"This update for openvswitch fixes the following issues\n\n- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).\n- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).\n","status":"published","published":"2026-06-22T10:55:10Z","modified":"2026-06-24T09:00:11.857539246Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}