CVE-2026-25804

Antrea has invalid enforcement order for network policy rules caused by integer overflow

State: Published
Severity: 8.0 High
Published: Feb 6, 2026
Updated: Feb 9, 2026
Reserved: Feb 5, 2026

Description

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.

Scores

CVSS	Score	Vector	Source
4.0	8.0 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U	GitHub_M

Weaknesses

CWE-287 Improper Authentication
CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
antreaantrea-io	< 2.3.2Affected >= 2.4.0, < 2.4.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.