Executive brief
Open vSwitch is a popular open-source software switch used in virtualized environments to manage network traffic. A vulnerability exists where an authorized user can request an extremely high number of internal processing threads, causing the system to run out of resources and crash. This results in a denial of service, potentially disrupting network connectivity for all virtual machines or services relying on the affected switch.
Technical details
A resource exhaustion vulnerability exists in Open vSwitch (OVS) v3.6.90 within the udpif_set_threads() function located in ofproto/ofproto-dpif-upcall.c. The software fails to perform an upper-bound validation check on the 'n-revalidator-threads' and 'n-handler-threads' configuration values. An attacker with OVSDB write privileges can set these values to an arbitrarily large integer via the other_config map. When OVS attempts to spawn the requested number of threads, it exhausts system resources (such as file descriptors for pipes), leading to a daemon abort and subsequent denial of service. This can be triggered either during initial bridge creation or by updating the configuration of an existing bridge.
Affected products
- Open vSwitch Open vSwitch 3.6.90
Timeline
- 2026-06-04: advisory: CVE published by NVD/MITRE