Skip to main content

Open vSwitch CVE-2026-36499

| EUVDEUVD-2026-34317 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-06-04 mitre GHSA-87x4-f37w-27p2
Denial Of Service N A
6.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
4.4 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Jun 04, 2026 - 21:33 vuln.today
CVSS changed
Jun 04, 2026 - 20:22 NVD
6.5 (MEDIUM)
CVE Published
Jun 04, 2026 - 00:00 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to request an excessive number of handler or revalidation threads. This can cause a denial of service (DoS) via resource exhaustion.

AnalysisAI

Resource exhaustion in Open vSwitch v3.6.90 allows an authenticated attacker with OVSDB write access to crash the virtual switch by requesting an unbounded number of handler or revalidation threads via a missing upper-bound check in the udpif_set_threads() function. The SSVC framework confirms a proof-of-concept exploit exists, though the vulnerability is not listed in CISA KEV and automated mass exploitation is assessed as unlikely due to the required management-plane authentication. With CVSS 6.5 and impact limited to availability, this is a moderate-priority finding that becomes high-priority in environments where OVSDB write access is broadly granted or inadequately segmented.

Technical ContextAI

Open vSwitch (OVS) is a production-grade open-source virtual switch widely deployed in SDN environments including OpenStack, Kubernetes (via OVN), and major cloud platforms. The OVSDB (Open vSwitch Database) protocol governs runtime configuration of OVS components. The vulnerable function udpif_set_threads() accepts thread count parameters submitted via OVSDB write operations and passes them to the underlying threading subsystem without validating an upper bound. This maps directly to CWE-770 (Allocation of Resources Without Limits or Throttling): the function trusts the caller-supplied integer without clamping it, enabling unbounded thread and memory allocation until the host is exhausted. The CPE string in the source data (cpe:2.3:a:n/a:n/a) is non-informative; the affected product and version are established solely by the CVE description identifying Open vSwitch v3.6.90. The GitHub reference at https://github.com/majdlatah/OVS-Other-Config-Bug is associated with the reported bug, likely containing proof-of-concept or issue reproduction details.

RemediationAI

No vendor-released patched version has been identified in the available intelligence - the upstream fix, if merged, would be tracked at https://github.com/majdlatah/OVS-Other-Config-Bug, but a tagged release containing the fix has not been independently confirmed; operators should monitor that reference and the official Open vSwitch release channel for a corrective release. As an immediate compensating control, restrict OVSDB write access to the minimum set of trusted management hosts using network-level ACLs or OVSDB role-based access controls, reducing the attack surface to only authorized orchestration systems; note that overly tight restrictions may break automated provisioning workflows. Additionally, deploy monitoring or alerting on OVSDB transactions that set anomalously large thread count values in the other_config or related keys, enabling detection before resource exhaustion occurs. On hypervisor or container host deployments, applying OS-level thread limits (e.g., ulimit -u) to the ovs-vswitchd process can serve as a safety net that bounds the blast radius, though this may cause thread allocation failures under legitimate high-load conditions.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.5 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-36499 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy