OVN CVE-2026-5367: OOB Read via Crafted DHCPv6 Leaking Heap Info

Bug 2455863 (CVE-2026-5367) Vulnerability Overview Multiple versions of OVN (Open Virtual Network) contain a vulnerability where an attacker can trigger an out-of-bounds read by crafting malicious DHCPv6 packets, thereby leaking adjacent information stored in heap memory. Impact Scope Affected Component: OVN (Open Virtual Network) Affected Functionality: DHCPv6 option configuration for Logical Switch Ports. Trigger Condition: When DHCPv6 options are configured, the userspace thread processes DHCPv6 requests. During processing, it copies part of the data. Specific Exploitation Scenario: When constructing a DHCPv6 ADVERTISE reply, the handler echoes the Client ID option. If the self-declared length of the option is not validated against the actual packet boundaries, an attacker can send a malicious DHCPv6 SOLICIT packet with an inflated Client ID length field. This causes to copy heap memory data beyond the valid packet boundary into the reply, which is then sent back to the attacker’s VM port. Remediation Fixed Version: Unspecified (Fixed in Version: unspecified) Current Status: New (Status: NEW) Reported Date: 2026-04-07 Last Modified: 2026-04-24 CC List: 5 users Environment: Unspecified Last Closed: Not closed Blocked: No Target Milestone: None Assigned To: Product Security DevOps Team QA Contact: None Documentation Contact: None URL: None Whiteboard: None Dependencies: None Blocks: None Tree View: Depends on / Blocks Attachments (Terms of Use) Description Notes You must log in to comment on or make changes to this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

OVN CVE-2026-5367: OOB Read via Crafted DHCPv6 Leaking Heap Info