CVE-2026-5367

A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.

An Important information disclosure flaw exists in OVN (Open Virtual Network) where a remote attacker can send specially crafted DHCPv6 SOLICIT packets to the ovn-controller. This can lead to an out-of-bounds read, disclosing sensitive heap memory information back to the attacker's virtual machine port. This vulnerability affects OVN deployments where DHCPv6 is enabled for logical switch ports.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The only potential mitigation is to disable the DHCPv6 feature for workloads attached to OVN logical ports, e.g.:

ovn-nbctl clear logical_switch_port <workload-port> dhcpv6_options.

We do not recommend mitigating the vulnerability this way because it will also disable legitimate DHCPv6 traffic originating from workloads connected to logical switch ports.