Junglewise Threat Intelligence

CVE-2026-5367: OVN information disclosure via crafted DHCPv6 packets in ovn-controller

CVE-2026-5367 · Severity: high · CVSS 8.6 · Published 2026-04-24

Executive brief

A security vulnerability has been identified in Open Virtual Network (OVN), a system used to manage virtual networking in cloud environments. An attacker can exploit this flaw by sending specially crafted network packets to the system, potentially allowing them to steal sensitive information from the server's memory. This could lead to the exposure of private data belonging to other users or the infrastructure itself, compromising the overall security of the virtualized environment.

Technical details

A vulnerability classified as an out-of-bounds read (CWE-130) exists in the ovn-controller component of OVN. The issue is triggered when the controller processes DHCPv6 SOLICIT packets containing an inflated Client ID length parameter. Because the software fails to properly validate the length of the Client ID against the actual packet size, it reads beyond the intended buffer. A remote, unauthenticated attacker can exploit this to leak sensitive information from heap memory, which is then transmitted back to the attacker's virtual machine port. Red Hat has released security updates (e.g., RHSA-2026:11694, RHSA-2026:11695) to address this issue in affected versions.

Affected products

  • Open Virtual Network OVN (Open Virtual Network) 2021, 23.06

Timeline

  • 2026-04-20: disclosed: Initial disclosure on oss-security mailing list
  • 2026-04-24: advisory: NVD and Red Hat published CVE details
  • 2026-04-29: patched: Red Hat released security updates for RHEL 8 and 9 Fast Datapath

References