Ovn: ovn: information disclosure via crafted dhcpv6 packets

Summary

A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.

Timeline

1. Apr 24, 2026, 12:25 PM UTCCVE published
2. Apr 24, 2026, 4:58 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Aug 25, 2026, 12:05 PM UTCRecord last updated

Affected versions

• ovn25.03

  Version range not reported

• ovn25.09

  Version range not reported

• ovn-2021

  Version range not reported

• ovn23.06

  Version range not reported

• ovn23.06

  Version range not reported

• ovn23.09

  Version range not reported

• ovn24.03

  Version range not reported

• ovn25.03

  Version range not reported

• ovn25.09

  Version range not reported

• ovn2.11

  Version range not reported

• ovn2.12

  Version range not reported

• ovn2.13

  Version range not reported

• ovn23.03

  Version range not reported

• ovn-2021

  Version range not reported

• ovn23.03

  Version range not reported

• ovn22.06

  Version range not reported

• ovn22.09

  Version range not reported

• ovn22.12

  Version range not reported

• ovn23.03

  Version range not reported

• ovn23.06

  Version range not reported

• ovn23.09

  Version range not reported

• ovn24.03

  Version range not reported

• ovn24.09

  Version range not reported

• ovn25.03

  Version range not reported

References 11