CVE-2026-34956
Medium · 5.9CVSS
5.9
EPSS
0.6%
Published
May 5, 2026
CISA due date
—
The record
A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | openvswitch | 0 | 3.5.4-160000.4.1 |
| openSUSE:Tumbleweed | openvswitch | 0 | 3.7.1-33.1 |
Related vulnerabilities
- CVE-2026-5265 When generating an ICMP Destination Unreachable or Packet Too Big response, the handler… Also affects openvswitch
- CVE-2026-5367 A flaw was found in OVN (Open Virtual Network). Also affects openvswitch
- CVE-2025-0650 A flaw was found in the Open Virtual Network (OVN). Also affects openvswitch
- CVE-2023-3966 A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve… Also affects openvswitch
- CVE-2023-5366 A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets… Also affects openvswitch
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-120
- CVE-2026-90804 A vulnerability was detected in GNU Binutils 2.47. CWE-120
- CVE-2026-90803 A security vulnerability has been detected in GNU Binutils 2.47. CWE-120