Riskcovery

CVE-2026-34956

Openvswitch: open vswitch: denial of service via malformed ftp epasv command

State
Published
Severity
5.9 Medium
Published
May 5, 2026
Updated
Nov 2, 2026
Reserved
Mar 31, 2026

Read the record on cve.org

Description

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Scores

CVSSScoreVectorSource
3.15.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat

Weaknesses

  • CWE-120 Buffer Copy without Checking Size of Input

Affected Products

ProductVersions
Fast Datapath for RHEL 7Red Hat
    Fast Datapath for RHEL 7Red Hat
      Fast Datapath for RHEL 7Red Hat
        Fast Datapath for RHEL 7Red Hat
          Fast Datapath for RHEL 7Red Hat
            Fast Datapath for RHEL 7Red Hat
              Fast Datapath for RHEL 7Red Hat
                Fast Datapath for RHEL 7Red Hat
                  Fast Datapath for RHEL 8Red Hat
                    Fast Datapath for RHEL 8Red Hat
                      Fast Datapath for RHEL 8Red Hat
                        Fast Datapath for RHEL 8Red Hat
                          Fast Datapath for RHEL 8Red Hat
                            Fast Datapath for RHEL 8Red Hat
                              Fast Datapath for RHEL 8Red Hat
                                Fast Datapath for RHEL 8Red Hat
                                  Fast Datapath for RHEL 8Red Hat
                                    Fast Datapath for RHEL 8Red Hat
                                      Fast Datapath for RHEL 9Red Hat
                                        Fast Datapath for RHEL 9Red Hat
                                          Fast Datapath for RHEL 9Red Hat
                                            Fast Datapath for RHEL 9Red Hat
                                              Fast Datapath for RHEL 9Red Hat
                                                Fast Datapath for RHEL 9Red Hat
                                                  Fast Datapath for RHEL 9Red Hat
                                                    Fast Datapath for RHEL 9Red Hat
                                                      Fast Datapath for RHEL 9Red Hat
                                                        Red Hat Enterprise Linux 7Red Hat
                                                          Red Hat OpenShift Container Platform 4Red Hat
                                                            Red Hat OpenShift Container Platform 4Red Hat
                                                              Red Hat OpenShift Container Platform 4Red Hat
                                                                Red Hat OpenShift Container Platform 4Red Hat
                                                                  Red Hat OpenShift Container Platform 4Red Hat
                                                                    Red Hat OpenStack Platform 13 (Queens)Red Hat
                                                                      Red Hat OpenStack Platform 13 (Queens)Red Hat
                                                                        Red Hat OpenStack Platform 13 (Queens)Red Hat
                                                                          Red Hat OpenStack Platform 16.2Red Hat
                                                                            Red Hat OpenStack Platform 16.2Red Hat
                                                                              Red Hat OpenStack Platform 17.1Red Hat
                                                                                Red Hat OpenStack Platform 17.1Red Hat
                                                                                  Red Hat OpenStack Platform 18.0Red Hat

                                                                                    References

                                                                                    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.