Open vSwitch CVE-2026-36499

No vendor-released patched version has been identified in the available intelligence - the upstream fix, if merged, would be tracked at https://github.com/majdlatah/OVS-Other-Config-Bug, but a tagged release containing the fix has not been independently confirmed; operators should monitor that reference and the official Open vSwitch release channel for a corrective release. As an immediate compensating control, restrict OVSDB write access to the minimum set of trusted management hosts using network-level ACLs or OVSDB role-based access controls, reducing the attack surface to only authorized orchestration systems; note that overly tight restrictions may break automated provisioning workflows. Additionally, deploy monitoring or alerting on OVSDB transactions that set anomalously large thread count values in the other_config or related keys, enabling detection before resource exhaustion occurs. On hypervisor or container host deployments, applying OS-level thread limits (e.g., ulimit -u) to the ovs-vswitchd process can serve as a safety net that bounds the blast radius, though this may cause thread allocation failures under legitimate high-load conditions.