CVE-2026-34956
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw was found in Open vSwitch. When configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in Denial of Service (DoS).
Risk Assessment
A remote attacker can cause a system crash, leading to service unavailability.
Recommendation
Update Open vSwitch to a patched version or restrict access to FTP services.
Other vulnerabilities in Open vSwitch
See all- CVE-2016-10377High
In Open vSwitch (OvS) 2.5.0, a malformed IP packet can cause the switch to read past the end of the packet buffer due to an unsigned integer underflow in the `miniflow_extract` function, permitting remote bypass of the access control list enforced by the switch.
- CVE-2017-9264Critical
In Open vSwitch (OvS) 2.6.1, there is a buffer over-read issue in the firewall implementation. This occurs while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp`, which can be triggered remotely.
- CVE-2016-2074Critical
Buffer overflow in lib/flow.c in ovs-vswitchd in Open vSwitch 2.2.x and 2.3.x before 2.3.3 and 2.4.x before 2.4.1 allows remote attackers to execute arbitrary code via crafted MPLS packets.
- CVE-2026-36499Medium
A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to request an excessive number of handler or revalidation threads, causing a denial of service (DoS) via resource exhaustion.
Original NVD description (English source)
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.