CVE-2020-35498

State: Published
Severity: 7.5 High
Published: Feb 11, 2021
Updated: Apr 23, 2025
Reserved: Dec 17, 2020

Description

A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-400

Affected Products

Product	Versions
openvswitchn/a	openvswitch 2.5.12, openvswitch 2.6.10, openvswitch 2.7.13, openvswitch 2.8.11, openvswitch 2.9.9, openvswitch 2.10.7, openvswitch 2.11.6, openvswitch 2.12.3, openvswitch 2.13.3, openvswitch 2.14.2Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1908845
https://www.openwall.com/lists/oss-security/2021/02/10/4
DSA-4852vendor-advisory
[debian-lts-announce] 20210219 [SECURITY] [DLA 2571-1] openvswitch security updatemailing-list
FEDORA-2021-fba11d37eevendor-advisory
GLSA-202311-16vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.