CVE-2026-5367 (CVSS 8.6)

Description

A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.

Is your site exposed to CVE-2026-5367?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS — Exploit Prediction

0.0002

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-130 CWE-130

References

Other References

https://access.redhat.com/errata/RHSA-2026:11694 https://access.redhat.com/errata/RHSA-2026:11695 https://access.redhat.com/errata/RHSA-2026:11696 https://access.redhat.com/errata/RHSA-2026:11698 https://access.redhat.com/errata/RHSA-2026:11700 https://access.redhat.com/errata/RHSA-2026:11701 https://access.redhat.com/errata/RHSA-2026:11702 https://access.redhat.com/security/cve/CVE-2026-5367 https://bugzilla.redhat.com/show_bug.cgi?id=2455863 http://www.openwall.com/lists/oss-security/2026/04/20/3

Frequently Asked Questions

What is CVE-2026-5367? +

A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port. It has a CVSS v3.1 base score of 8.6 (HIGH).

How severe is CVE-2026-5367? +

CVE-2026-5367 has a CVSS v3.1 score of 8.6 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0002, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-5367? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-115794

P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a …

CVE-2026-94633

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue …

CVE-2026-14587

Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. …

CVE-2026-116531

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside …

CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced …

CVE-2026-3868

An improper handling of the length parameter inconsistency vulnerability has been identified in Moxa’s Secure Router. Because of improper validation …