CVE-2026-5367 Details

A vulnerability exists in OVN (Open Virtual Network) versions through 2.13 and 22.03, 22.06, and 22.09. A remote attacker can exploit this flaw by sending specially crafted DHCPv6 SOLICIT packets with an exaggerated Client ID length. This manipulation causes the ovn-controller to perform an out-of-bounds read, accessing sensitive information in heap memory. The leaked data is then sent back to the attacker's virtual machine port. This issue arises when DHCPv6 is enabled for logical switch ports, allowing the exploitation of user-controlled packet data without proper validation.

There is no recommended fix for this vulnerability, as disabling DHCPv6 on affected logical ports will also interrupt legitimate DHCPv6 traffic from connected workloads.