CVE-2026-34956
Openvswitch: open vswitch: denial of service via malformed ftp epasv command
CVE-2026-34956 is a medium vulnerability (CVSS 5.9) in Red Hat Fast Datapath For Rhel 7, published April 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 35th percentile. Fixed in openvswitch 3.3.0-3.
- Severity
- 5.9 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.40%EPSS, 35th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.3.0-3openvswitch +26 more
Description
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openvswitchAzure Linux:3 | before 3.3.0-3 | 3.3.0-3 |
openvswitchDebian:12 | All versions, plus listed versions 3.1.0-23.1.0-2+deb12u13.1.2-13.1.2-23.1.2-3 Show 33 moreShow less3.1.2-43.2.0-13.2.0-23.2.2~git20231029-13.2.2~git20231029-23.3.0-13.3.0-23.3.0-33.3.0-43.3.0-53.3.0~git20240118.e802fe7-13.3.0~git20240118.e802fe7-23.3.0~git20240118.e802fe7-33.3.1-13.4.0-13.5.0-13.5.0~git20241129.2af7cef-13.5.0~git20241129.2af7cef-23.6.0-13.6.0-23.6.0-33.6.0-53.6.0-63.6.0-73.7.0-13.7.0~git20260211.8c6ebf8-1~1.gbp9127d13.7.0~git20260211.8c6ebf8-1~1.gbp9127d23.7.0~git20260211.8c6ebf8-1~1.gbp9127d33.7.1-13.7.1-23.7.1-34.0.0-14.0.0-2 | None known |
openvswitchDebian:13 | All versions, plus listed versions 3.5.0-13.6.0-13.6.0-23.6.0-33.6.0-5 Show 11 moreShow less3.6.0-63.6.0-73.7.0-13.7.0~git20260211.8c6ebf8-1~1.gbp9127d13.7.0~git20260211.8c6ebf8-1~1.gbp9127d23.7.0~git20260211.8c6ebf8-1~1.gbp9127d33.7.1-13.7.1-23.7.1-34.0.0-14.0.0-2 | None known |
openvswitchDebian:14 | before 3.7.1-1, plus listed versions 3.5.0-13.6.0-13.6.0-23.6.0-33.6.0-5 Show 6 moreShow less3.6.0-63.6.0-73.7.0-13.7.0~git20260211.8c6ebf8-1~1.gbp9127d13.7.0~git20260211.8c6ebf8-1~1.gbp9127d23.7.0~git20260211.8c6ebf8-1~1.gbp9127d3 | 3.7.1-1 |
openvswitchopenEuler:22.03-LTS-SP4 | before 2.12.4-9.oe2203sp4 | 2.12.4-9.oe2203sp4 |
openvswitchopenEuler:24.03-LTS-SP1 | before 3.2.1-5.oe2403sp1 | 3.2.1-5.oe2403sp1 |
openvswitchopenEuler:24.03-LTS | before 3.2.1-5.oe2403 | 3.2.1-5.oe2403 |
openvswitchopenEuler:24.03-LTS-SP2 | before 3.2.1-5.oe2403sp2 | 3.2.1-5.oe2403sp2 |
openvswitchopenEuler:24.03-LTS-SP3 | before 3.2.1-5.oe2403sp3 | 3.2.1-5.oe2403sp3 |
openvswitchopenEuler:20.03-LTS-SP4 | before 2.12.4-11.oe2003sp4 | 2.12.4-11.oe2003sp4 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openvswitchSUSE:Linux Enterprise Module for Package Hub 15 SP7 | before 3.5.4-150700.41.15.1 | 3.5.4-150700.41.15.1 |
openvswitchSUSE:Linux Enterprise Module for Server Applications 15 SP7 | before 3.5.4-150700.41.15.1 | 3.5.4-150700.41.15.1 |
openvswitch3SUSE:Linux Enterprise Micro 5.5 | before 3.1.7-150500.3.28.1 | 3.1.7-150500.3.28.1 |
openvswitchSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | before 2.11.5-3.30.1 | 2.11.5-3.30.1 |
openvswitchSUSE:Linux Micro 6.0 | before 3.1.7-5.1 | 3.1.7-5.1 |
openvswitchSUSE:Linux Micro 6.1 | before 3.1.7-slfo.1.1_3.1 | 3.1.7-slfo.1.1_3.1 |
openvswitchSUSE:Linux Micro 6.2 From an advisory covering 3 CVEs | before 3.5.4-160000.4.1 | 3.5.4-160000.4.1 |
openvswitchSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs | before 3.5.4-160000.4.1 | 3.5.4-160000.4.1 |
openvswitchSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs | before 3.5.4-160000.4.1 | 3.5.4-160000.4.1 |
openvswitchUbuntu:Pro:18.04:LTS | All versions, plus listed versions 2.8.0-0ubuntu22.8.1-0ubuntu22.8.1-0ubuntu32.9.0~git20180205.5a39582ca-0ubuntu12.9.0-0ubuntu1 Show 9 moreShow less2.9.2-0ubuntu0.18.04.22.9.2-0ubuntu0.18.04.32.9.5-0ubuntu0.18.04.12.9.7-0ubuntu0.18.04.22.9.8-0ubuntu0.18.04.22.9.8-0ubuntu0.18.04.32.9.8-0ubuntu0.18.04.42.9.8-0ubuntu0.18.04.52.9.8-0ubuntu0.18.04.5+esm1 | None known |
openvswitchUbuntu:20.04:LTS | All versions, plus listed versions 2.12.0-0ubuntu12.12.0-0ubuntu22.12.1~git20191107.7accd1302-0ubuntu12.12.90~git20200107.af683565b-0ubuntu12.12.90~git20200107.af683565b-0ubuntu2 Show 16 moreShow less2.12.90~git20200107.af683565b-0ubuntu32.13.0~git20200127.dbdf66c29-0ubuntu22.13.0~git20200212.15ae9db33-0ubuntu12.13.0~git20200212.15ae9db33-0ubuntu22.13.0-0ubuntu12.13.1-0ubuntu0.20.04.12.13.1-0ubuntu0.20.04.32.13.1-0ubuntu0.20.04.42.13.3-0ubuntu0.20.04.12.13.3-0ubuntu0.20.04.22.13.5-0ubuntu12.13.8-0ubuntu12.13.8-0ubuntu1.12.13.8-0ubuntu1.22.13.8-0ubuntu1.32.13.8-0ubuntu1.4 | None known |
openvswitchUbuntu:22.04:LTS | All versions, plus listed versions 2.16.0-0ubuntu22.16.0-0ubuntu32.16.0-0ubuntu42.17.0~git20220105.0d1ffb7-0ubuntu12.17.0~git20220118.1b9fd88-0ubuntu1 Show 12 moreShow less2.17.0~git20220121.109d024-0ubuntu12.17.0-0ubuntu12.17.2-0ubuntu0.22.04.12.17.2-0ubuntu0.22.04.22.17.3-0ubuntu0.22.04.12.17.3-0ubuntu0.22.04.22.17.5-0ubuntu0.22.04.22.17.7-0ubuntu0.22.04.12.17.8-0ubuntu0.22.04.12.17.9-0ubuntu0.22.04.12.17.9-0ubuntu0.22.04.22.17.12-0ubuntu0.22.04.1 | None known |
openvswitchUbuntu:24.04:LTS | All versions, plus listed versions 3.2.0-13.2.0-23.2.0-2build13.2.2~git20231029-23.2.2~git20231029-2build1 Show 11 moreShow less3.3.0~git20240118.e802fe7-23.3.0~git20240118.e802fe7-33.3.0-13.3.0-1build13.3.0-1ubuntu13.3.0-1ubuntu33.3.0-1ubuntu3.13.3.0-1ubuntu3.23.3.4-0ubuntu0.24.04.13.3.4-0ubuntu0.24.04.23.3.9-0ubuntu0.24.04.1 | None known |
openvswitchUbuntu:25.10 | All versions, plus listed versions 3.5.0-1build13.5.1-0ubuntu13.6.0-13.6.0-23.6.0-2ubuntu0.1 | None known |
openvswitchUbuntu:26.04:LTS | All versions, plus listed versions 3.6.0-23.6.0-2build13.6.0-53.6.0-63.6.0-6build1 Show 6 moreShow less3.6.0-6ubuntu23.7.0~git20260211.8c6ebf8-1~1.gbp9127d13.7.0-13.7.0-1build13.7.1-13.7.1-2 | None known |
openvswitchopenSUSE:Tumbleweed | before 3.7.1-33.1 | 3.7.1-33.1 |
openvswitchopenSUSE:Leap 16.0 From an advisory covering 3 CVEs | before 3.5.4-160000.4.1 | 3.5.4-160000.4.1 |
What each source reports
CVE List Score used
Openvswitch: open vswitch: denial of service via malformed ftp epasv command
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.
- Record
CVE-2026-34956- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-05
EUVDEUVD-2026-27345
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.
- Record
EUVD-2026-27345- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-q5f5-xxh8-jx9h
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP...
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.
- Record
GHSA-q5f5-xxh8-jx9h- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.
- Record
CVE-2026-34956- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-05
OSVDEBIAN-CVE-2026-34956
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.
- Record
DEBIAN-CVE-2026-34956- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1871
openvswitch security update
Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.
Security Fix(es):
"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'
- Record
OESA-2026-1871- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 18 moreShow less
OSVOESA-2026-1872
openvswitch security update
Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.
Security Fix(es):
"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'
- Record
OESA-2026-1872- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1960
openvswitch security update
Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.
Security Fix(es):
"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'
- Record
OESA-2026-1960- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1961
openvswitch security update
Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.
Security Fix(es):
"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'
- Record
OESA-2026-1961- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-1962
openvswitch security update
Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.
Security Fix(es):
"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'
- Record
OESA-2026-1962- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-2063
openvswitch security update
Open vSwitch provides standard network bridging functions and support for the OpenFlow protocol for remote per-flow control of traffic.
Security Fix(es):
"Description\n===========\n\nMultiple versions of Open vSwitch are vulnerable to crafted FTP payloads\ncausing invalid memory accesses, potential denial of service, and possible\nremote code execution. This impacts the userspace implementation of\nconntrack. Triggering the vulnerability requires that Open vSwitch has\nconfigured conntrack flows specifying the FTP alg handler. Conntrack\nhandlers in userspace are not automatically applied.\n\nThe issue is caused by type narrowing when copying FTP substrings. It\nhas existed in all versions of the userspace conntrack supporting the\nFTP handler. This was introduced with Open vSwitch version 2.8.0 and\naffects all versions up to 3.7.0.\n\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned CVE-2026-34956 identifier to this issue. At the time of writing\nthe flaw is considered with Moderate impact and 5.9 CVSS.\n\n\nMitigation\n==========\n\nFor any affected version of Open vSwitch, avoiding the FTP alg will\nprevent the issue from triggering. The Open vSwitch team does not\nrecommend attempting to mitigate the vulnerability this way because it\nmay impact packet forwarding.\n\nBy default, alg handlers are not installed, and must be added as part\nof the OpenFlow rules (via 'ct(alg=ftp)' for example).\n\nUsers can check if they are using affected flows by looking at their\nOpenFlow ruleset for their bridges, for example:\n\n ovs-ofctl dump-flows <bridge> | grep 'alg=ftp'\n\nWe have found that Open vSwitch may be subject to heap corruption when\nprocessing FTP messages.\n\n\nFix\n===\n\nPatches to fix this vulnerability in Open vSwitch 3.3 and newer are\napplied to the appropriate branches, and the original patch is located\nat:", 'Recommendation\n==============\n\nWe recommend that users of Open vSwitch apply the included patch, or\nupgrade to a known patched version of Open vSwitch. These include:\n\n* 3.3.9\n* 3.4.6\n* 3.5.4\n* 3.6.3\n* 3.7.1\n\n\nAcknowledgements\n================\n\nThe Open vSwitch team wishes to thank the reporter:\n\n * Seiji Sakurai <Seiji.Sakurai () outlook com>'
- Record
OESA-2026-2063- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-34956
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.
- Record
UBUNTU-CVE-2026-34956- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-86781No score
CVE-2026-34956 affecting package openvswitch for versions less than 3.3.0-3
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.
- Record
AZL-86781- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10534-1No score
libopenvswitch-3_7-0-3.7.1-33.1 on GA media
These are all security issues fixed in the libopenvswitch-3_7-0-3.7.1-33.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10534-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20972-1No score
Security update for openvswitch
This update for openvswitch fixes the following issues
- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
Changes for openvswitch:
- Update ovn to 25.03.3
- Bug fixes
- Add support for special port_security prefix "VRRPv3". This prefix allows CMS to allow all required traffic for a VRRPv3 virtual router behind LSP. See ovn-nb(5) man page for more details.
- Fixed support for fragmented traffic in the userspace datapath. Added the "acl_ct_translation" NB_Global option to enable connection tracking based L4 field translation for stateful ACLs. When enabled allows proper handling of IP fragmentation in userspace datapaths. This option may break hardware offloading and is disabled by default.
- Added disable_garp_rarp option to logical_router table in order to disable GARP/RARP announcements by all the peer ports of this logical router.
- Update openvswitch to 3.5.4
- Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt
- OVS validated with DPDK 24.11.4.
- Fixed buffer overflow during conntrack processing of alg=ftp in userspace datapath (CVE-2026-34956) (bsc#1261273).
- Update openvswitch to 3.5.3
- Full changelog https://www.openvswitch.org/releases/NEWS-3.5.3.txt
- Bug fixes
- Record
openSUSE-SU-2026:20972-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1306-1No score
Security update for openvswitch
This update for openvswitch fixes the following issues:
- CVE-2026-34956: invalid memory access via crafted FTP payloads in userspace conntrack flows specifying the FTP alg handler (bsc#1261273).
- Record
SUSE-SU-2026:1306-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1439-1No score
Security update for openvswitch
This update for openvswitch fixes the following issue:
Security updates:
- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
Other updates:
- Update openvswitch to 3.5.4
- Record
SUSE-SU-2026:1439-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1440-1No score
Security update for openvswitch3
This update for openvswitch3 fixes the following issues:
- CVE-2026-34956: invalid memory access via crafted FTP payloads in userspace conntrack flows specifying the FTP alg handler (bsc#1261273).
- Record
SUSE-SU-2026:1440-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1482-1No score
Security update for openvswitch
This update for openvswitch fixes the following issues:
- CVE-2026-34956: invalid memory access via crafted FTP payloads in userspace conntrack flows specifying the FTP alg handler (bsc#1261273).
- Record
SUSE-SU-2026:1482-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1871-1No score
Security update for openvswitch
This update for openvswitch fixes the following issue:
- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
- Record
SUSE-SU-2026:1871-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:21250-1No score
Security update for openvswitch
This update for openvswitch fixes the following issue:
- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
- Record
SUSE-SU-2026:21250-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22068-1No score
Security update for openvswitch
This update for openvswitch fixes the following issue
- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
- Record
SUSE-SU-2026:22068-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22145-1No score
Security update for openvswitch
This update for openvswitch fixes the following issues
- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
Changes for openvswitch:
- Update ovn to 25.03.3
- Bug fixes
- Add support for special port_security prefix "VRRPv3". This prefix allows CMS to allow all required traffic for a VRRPv3 virtual router behind LSP. See ovn-nb(5) man page for more details.
- Fixed support for fragmented traffic in the userspace datapath. Added the "acl_ct_translation" NB_Global option to enable connection tracking based L4 field translation for stateful ACLs. When enabled allows proper handling of IP fragmentation in userspace datapaths. This option may break hardware offloading and is disabled by default.
- Added disable_garp_rarp option to logical_router table in order to disable GARP/RARP announcements by all the peer ports of this logical router.
- Update openvswitch to 3.5.4
- Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt
- OVS validated with DPDK 24.11.4.
- Fixed buffer overflow during conntrack processing of alg=ftp in userspace datapath (CVE-2026-34956) (bsc#1261273).
- Update openvswitch to 3.5.3
- Full changelog https://www.openvswitch.org/releases/NEWS-3.5.3.txt
- Bug fixes
- Record
SUSE-SU-2026:22145-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22152-1No score
Security update for openvswitch
This update for openvswitch fixes the following issues
- CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
- CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).
- CVE-2026-34956: Invalid memory access in conntrack FTP alg (bsc#1261273).
Changes for openvswitch:
- Update ovn to 25.03.3
- Bug fixes
- Add support for special port_security prefix "VRRPv3". This prefix allows CMS to allow all required traffic for a VRRPv3 virtual router behind LSP. See ovn-nb(5) man page for more details.
- Fixed support for fragmented traffic in the userspace datapath. Added the "acl_ct_translation" NB_Global option to enable connection tracking based L4 field translation for stateful ACLs. When enabled allows proper handling of IP fragmentation in userspace datapaths. This option may break hardware offloading and is disabled by default.
- Added disable_garp_rarp option to logical_router table in order to disable GARP/RARP announcements by all the peer ports of this logical router.
- Update openvswitch to 3.5.4
- Full changelog https://www.openvswitch.org/releases/NEWS-3.5.4.txt
- OVS validated with DPDK 24.11.4.
- Fixed buffer overflow during conntrack processing of alg=ftp in userspace datapath (CVE-2026-34956) (bsc#1261273).
- Update openvswitch to 3.5.3
- Full changelog https://www.openvswitch.org/releases/NEWS-3.5.3.txt
- Bug fixes
- Record
SUSE-SU-2026:22152-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, NVD | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/security/cve/CVE-2026-34956
bugzilla.redhat.com/show_bug.cgi?id=2453459
openwall.com/lists/oss-security/2026/03/31/15
nvd.nist.gov/vuln/detail/CVE-2026-34956
github.com/advisories/GHSA-q5f5-xxh8-jx9h
security-tracker.debian.org/tracker/CVE-2026-34956
Show 24 moreShow less
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1871
suse.com/support/update/announcement/2026/suse-su-20261306-1
bugzilla.suse.com/1261273
ubuntu.com/security/CVE-2026-34956
cve.org/CVERecord?id=CVE-2026-34956
mail.openvswitch.org/pipermail/ovs-dev/2026-March/431425.html