VulnSocial

CVE-2026-34956Disclosure

LOWCVSS 5.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Open vSwitch. When Open vSwitch is configured with a conntrack flow using FTP helpers over the userspace datapath, a remote attacker can send a specially crafted FTP stream with an EPASV command exceeding 255 characters. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-120

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-03-31); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-03-31: 1Mentions · 2026-04-02: 1Mentions · 2026-05-27: 1Patch / Workaround · 2026-03-31: 1Technical Details · 2026-04-02: 1Technical Details · 2026-05-27: 103-3104-0205-27
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-311
Patch1
2026-04-021
Disclosure1
2026-05-271
Disclosure1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    CVE-2026-34956: Open vSwitch: Invalid memory access in conntrack FTP alg https://www.openwall.com/lists/oss-security/2026/03/31/15 Crafted FTP payloads causing invalid memory accesses, potential denial of service, and possible remote code execution. This impacts the userspace implementation of conntrack.

    Post summary

    The post announces CVE‑2026‑34956, a memory‑corruption flaw in Open vSwitch’s conntrack FTP algorithm that could lead to DoS or RCE, and links to an Openwall mailing‑list discussion; it provides technical details but no exploit code or patch information.

    01151521
    4.6K followersView on X
  • Motonori Shindo / 進藤資訓 @ ヴイエムウェア最高技術責任者（北アジア担当）@motonori_shindo
    Patch

    Open vSwitch 3.7.1、3.6.3、3.5.4、3.4.6 および 3.3.9 がリリースされました。CVE-2026-34956 への対応を含む bug-fix リリースです。 https://mail.openvswitch.org/pipermail/ovs-announce/2026-March/000392.html

    Post summary

    A bug‑fix release for Open vSwitch versions 3.7.1 through 3.3.9 includes a security fix for CVE‑2026‑34956, with details available in the provided mailing list link.

    02010360
    1.5K followersView on X
  • WindowsForum@windowsforum
    Disclosure

    🚨 Open vSwitch FTP ALG DoS (CVE-2026-34956) crashing conntrack because someone yelled a 300-char EPASV? Love when “legacy helpers” hold modern networks hostage. Patch fast—virtual plumbing is still soft. https://windowsforum.com/threads/cve-2026-34956-open-vswitch-ftp-alg-dos-why-windows-teams-should-care.420046/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #OpenVswitch #WindowsServerSecurity #FtpAlgDos https://t.co/i5tpUXgMrI

    Post summary

    The tweet announces a DoS vulnerability in Open vSwitch FTP ALG (CVE-2026-34956) that can crash conntrack, urging quick patching without providing detailed PoC or exploit code.

    0000046
    1.1K followersView on X

Explore more

Back to dashboard