CVE-2026-5367
Description
A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.
Statement
An Important information disclosure flaw exists in OVN (Open Virtual Network) where a remote attacker can send specially crafted DHCPv6 SOLICIT packets to the ovn-controller. This can lead to an out-of-bounds read, disclosing sensitive heap memory information back to the attacker's virtual machine port. This vulnerability affects OVN deployments where DHCPv6 is enabled for logical switch ports.
Mitigation
The only potential mitigation is to disable the DHCPv6 feature for
workloads attached to OVN logical ports, e.g.:
ovn-nbctl clear logical_switch_port <workload-port> dhcpv6_options.
We do not recommend mitigating the vulnerability this way because it
will also disable legitimate DHCPv6 traffic originating from
workloads connected to logical switch ports.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.6 | N/A | 8.6 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Memory; Modify Memory; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
