CVE-2026-34956: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-34956 is a heap buffer overflow vulnerability in Open vSwitch (OVS) affecting the userspace conntrack FTP ALG (Application Layer Gateway) handler. When OVS is configured with conntrack flows using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream containing an EPASV command exceeding 255 characters, triggering an invalid memory access that crashes the OVS process. The flaw was introduced in Open vSwitch version 2.8.0 and affects all versions up to 3.7.0; patched versions include 3.3.9, 3.4.6, 3.5.4, 3.6.3, and 3.7.1. It was publicly disclosed on March 31, 2026 via the oss-security mailing list and formally published to NVD on May 5, 2026. The CVSS v3.1 base score is 5.9 (Medium) (Openwall oss-sec, Github Advisory).

The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input / Classic Buffer Overflow). Specifically, the vulnerability arises from type narrowing when copying FTP substrings within the userspace conntrack FTP ALG handler — when an EPASV command exceeding 255 characters is received, the length is truncated due to the type narrowing, resulting in a heap access error (Openwall oss-sec). Exploitation requires that OVS has been explicitly configured with conntrack flows specifying the FTP ALG handler (e.g., via ct(alg=ftp) in OpenFlow rules); by default, ALG handlers are not installed, limiting the attack surface. The advisory notes the potential for heap corruption and, in addition to DoS, mentions the possibility of remote code execution, though the primary assessed impact is denial of service (Openwall oss-sec, Red Hat Bugzilla). A patch was published to the OVS development mailing list at the time of disclosure.

Successful exploitation causes the Open vSwitch process to crash, resulting in a Denial of Service (DoS) condition that disrupts all network traffic processing on the affected system. No authentication is required to trigger the vulnerability, and the attack can be launched remotely over the network. There is no confidentiality or integrity impact assessed; the vulnerability is limited to availability. In virtualized or cloud environments where OVS serves as the virtual switch fabric, a crash could disrupt connectivity for multiple tenants or workloads simultaneously (Openwall oss-sec, Github Advisory).

There is no public proof-of-concept exploit code known at this time, and no evidence of in-the-wild exploitation has been reported (Github Advisory). The EPSS score is approximately 0.098% (0.00098), indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement that the target OVS instance must be explicitly configured with FTP ALG conntrack flows, reducing the population of vulnerable systems (Openwall oss-sec).

1. Reconnaissance: Identify network environments using Open vSwitch versions 2.8.0 through 3.7.0 as a virtual switch, particularly in OpenStack, OVN, or similar SDN deployments where FTP traffic is handled.
2. Verify FTP ALG configuration: Determine whether the target OVS instance has FTP ALG conntrack flows configured by checking for ct(alg=ftp) entries in OpenFlow rules (e.g., ovs-ofctl dump-flows | grep 'alg=ftp').
3. Craft malicious FTP stream: Construct a specially crafted FTP session that includes an EPASV command payload exceeding 255 characters in length, exploiting the type narrowing flaw in the FTP substring copy logic.
4. Deliver payload: Send the malicious FTP stream through the network path monitored by the vulnerable OVS conntrack FTP ALG handler, targeting the userspace datapath.
5. Trigger crash: The oversized EPASV command causes a heap access error in the OVS userspace process, resulting in a crash and DoS condition affecting all traffic processed by that OVS instance (Openwall oss-sec).

• Logs: Unexpected crashes or core dumps from the ovs-vswitchd or ovsdb-server processes; kernel or system logs showing segmentation faults or heap corruption errors associated with OVS userspace processes.
• Process: Sudden termination and restart of the ovs-vswitchd process; monitoring tools reporting OVS service unavailability or repeated restarts.
• Network: Anomalous FTP traffic flows passing through OVS-managed interfaces containing unusually long EPASV command strings (>255 characters); unexpected drops in network throughput or connectivity loss for VMs/containers behind OVS.
• File System: Core dump files generated in the OVS working directory following a crash event.

Upgrade Open vSwitch to one of the patched versions: 3.3.9, 3.4.6, 3.5.4, 3.6.3, or 3.7.1. The upstream patch is available at the OVS development mailing list (Openwall oss-sec). As a workaround, remove or avoid configuring FTP ALG conntrack flows (i.e., do not use ct(alg=ftp) in OpenFlow rules); administrators can audit existing flows with ovs-ofctl dump-flows | grep 'alg=ftp'. SUSE has released security updates for its openvswitch and openvswitch3 packages (openSUSE Security, SUSE Advisory). The OVS team notes that disabling the FTP ALG may impact packet forwarding and recommends patching as the preferred remediation.

The vulnerability was responsibly disclosed by reporter Seiji Sakurai and coordinated through the Open vSwitch security team, with Aaron Conole publishing the advisory to the oss-security mailing list on March 31, 2026 (Openwall oss-sec). Red Hat tracked the issue via Bugzilla and assigned it medium severity, consistent with the CVSS score (Red Hat Bugzilla). SUSE issued security updates for its OVS packages shortly after the patch was published. Coverage has been limited to security advisory aggregators and Linux distribution security channels, with no significant broader media attention given the moderate severity and constrained exploitation conditions.