Open vSwitch CVE-2026-34956

Upgrade Open vSwitch to a patched version released after 2026/03/31; exact version not confirmed from available data - check Red Hat advisory and Open vSwitch project releases for the specific fix version. If immediate patching is not feasible, disable the FTP ALG feature in conntrack configuration (typically via 'nf_conntrack_ftp' module on Linux hosts) to eliminate the attack surface; this is effective but may break legitimate FTP connection tracking in stateful firewall rules, requiring review of firewall policies. Alternatively, restrict FTP traffic (ports 20-21) at network ACLs or firewall ingress rules to only trusted administrative or client subnets, reducing exposure to untrusted attackers. Monitor Open vSwitch logs for FTP protocol errors or crashes as a detection signal. Reference Red Hat advisory: https://access.redhat.com/security/cve/CVE-2026-34956.