PatchRadar

← Browse

CVE-2026-5367

Medium

Elevated severity or exploit probability.

CVSS base
8.6 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS — probability of exploitation (30 days)
0.9%
57.3th percentile
CISA KEV
Not listed
Weakness / dates
CWE-130
Published 2026-04-24 · modified 2026-08-25

Description

A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.

References

Official: NVD · CVE.org