Open vSwitch up to 3.7.0 FTP alg memory corruption

Summaryinfo

A vulnerability was found in Open vSwitch up to 3.3.8/3.4.5/3.5.3/3.6.2/3.7.0 and classified as critical. This issue affects some unknown processing of the component FTP alg Handler. Executing a manipulation can lead to memory corruption. This vulnerability is registered as CVE-2026-34956. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Open vSwitch up to 3.3.8/3.4.5/3.5.3/3.6.2/3.7.0 and classified as critical. This vulnerability affects an unknown code of the component FTP alg Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

The advisory is shared for download at seclists.org. This vulnerability was named CVE-2026-34956. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 307427 (SUSE SLES15 Security Update : openvswitch (SUSE-SU-2026:1439-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.3.9, 3.4.6, 3.5.4, 3.6.3 or 3.7.1 eliminates this vulnerability. The upgrade is hosted for download at mail.openvswitch.org.

The vulnerability is also documented in the vulnerability database at Tenable (307427). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Open vSwitch

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.3.5
• 3.3.6
• 3.3.7
• 3.3.8
• 3.4
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.5
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.6
• 3.6.0
• 3.6.1
• 3.6.2
• 3.7.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion