CVE-2021-3905

openvswitch: External triggered memory leak in Open vSwitch while processing fragmented packets

Loading…

Severity

Moderate

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · September 29, 2021

Updated · June 28, 2026

Description

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.

Statement

Red Hat Enterprise Linux 7 provides the openvswitch package only through the unsupported Optional repository. Customers are advised to install Open vSwitch (OVS) from RHEL Fast Datapath instead.

Red Hat OpenStack Platform deployments are not affected because they use OVS/OVN directly from the Fast Datapath channel. Any updates will be distributed through that channel.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-401 · Missing Release of Memory after Effective Lifetime