CVE-2026-5367
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2026-5367 is a high-severity Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability in Redhat (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 44% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-5367 is a vulnerability in OVN (Open Virtual Network), specifically affecting the ovn-controller component. The flaw stems from improper handling of DHCPv6 SOLICIT packets with an inflated Client ID length (CWE-130), causing ovn-controller to perform an out-of-bounds read beyond the packet boundaries. This exposes sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port. The issue was published on 2026-04-24 and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
A remote attacker can exploit this vulnerability without authentication or privileges by sending crafted DHCPv6 SOLICIT packets to the ovn-controller. No user interaction is required, and the attack has low complexity due to its network accessibility. Exploitation results in high-impact confidentiality loss, as sensitive heap memory contents are disclosed directly to the attacker's virtual machine port, with changed scope due to the cross-VM information flow.
Red Hat advisories detail mitigations through updated packages in errata RHSA-2026:11694, RHSA-2026:11695, RHSA-2026:11696, RHSA-2026:11698, and RHSA-2026:11700, which security practitioners should apply to vulnerable OVN deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25421
Vulnerability Data
A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of…
more
a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.5.5V4.2.1V4.2.2
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover length-parameter inconsistencies through targeted parsing tests.
Input validation enforces correct length-to-data consistency checks on parsed messages before processing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce length validation and input sanitization during coding and review.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect length-inconsistency vulnerabilities before deployment.
Secure development lifecycle mandates input validation and length checks that directly address inconsistent length fields.
Application security requirements include explicit rules for handling message lengths and data structures.
Secure architecture principles require robust parsing and bounds checking to prevent length-related flaws.
Secure coding standards directly prohibit improper length handling and enforce defensive parsing practices.