# CVE-2026-34956: Openvswitch: open vswitch: denial of service via malformed ftp epasv command

Status: published. Published: 2026-05-05. Updated: 2026-11-02.

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

## Remediation

- workaround: Optionally, avoid using alg=ftp flows. These are not usually configured. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Fast Datapath for RHEL 7 (openvswitch): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 7 (openvswitch2.10): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 7 (openvswitch2.11): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 7 (openvswitch2.12): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 7 (openvswitch2.13): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 7 (openvswitch-selinux-extra-policy): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 7 (ovn2.11): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 7 (ovn2.12): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (openvswitch2.11): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (openvswitch2.12): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (openvswitch2.13): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (openvswitch2.15): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (openvswitch2.16): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (openvswitch2.17): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (openvswitch3.1): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (openvswitch-selinux-extra-policy): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (ovn2.11): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 8 (ovn2.12): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 9 (openvswitch2.17): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 9 (openvswitch3.0): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 9 (openvswitch3.1): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 9 (openvswitch3.2): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 9 (openvswitch3.3): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 9 (openvswitch3.4): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 9 (openvswitch3.5): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 9 (openvswitch3.6): Version range not reported. Source: CNA: redhat
- Red Hat / Fast Datapath for RHEL 9 (openvswitch-selinux-extra-policy): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (openvswitch): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openvswitch2.17): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openvswitch3.0): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openvswitch3.1): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 13 (Queens) (rhosp13/openstack-neutron-openvswitch-agent): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 13 (Queens) (rhosp13/openstack-openvswitch-base): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 13 (Queens) (rhosp13/openstack-ovn-base): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 16.2 (rhosp-openvswitch): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 16.2 (rhosp-rhel8/openstack-neutron-openvswitch-agent): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 17.1 (rhosp-openvswitch): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 17.1 (rhosp-rhel9/openstack-neutron-openvswitch-agent): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenStack Platform 18.0 (rhoso-openvswitch): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 5.9 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 0.40% as of 2026-11-01; percentile 34.78%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-120

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-34956 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2453459 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- http://www.openwall.com/lists/oss-security/2026/03/31/15 (ADP: CVE)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-34956; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-34956; retrieved 2026-11-02; source updated Not reported

Revision: 926b97513ccbb6f7d766cfbda173ad94486ae59b42489b75453520e97443ad4e

Canonical: https://y2.dev/cve/CVE-2026-34956