When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion of the original packet into the ICMP error body using the IP header's self-declared total length (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the ICMP response sent back to the VM.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2481-1 advisory.

    This update for openvswitch fixes the following issues

    - CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
    - CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2475-1 advisory.

    This update for openvswitch fixes the following issues

    - CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
    - CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2476-1 advisory.

    This update for openvswitch3 fixes the following issues

    - CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
    - CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2463-1 advisory.

    This update for openvswitch fixes the following issues

    Update ovn to 25.03.3:

    - CVE-2026-5265: heap over-read in ICMP error response generation (bsc#1262498).
    - CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing (bsc#1262499).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22110 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22111 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11701 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11700 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11698 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11695 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11696 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11694 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11702 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When generating an ICMP Destination Unreachable or Packet Too Big response, the handler copies a portion     of the original packet into the ICMP error body using the IP header's self-declared total length     (ip_tot_len for IPv4, ip6_plen for IPv6) without validating it against the actual packet buffer size. A VM     can send a short packet with an inflated IP length field that triggers an ICMP error (e.g., by hitting a     reject ACL), causing ovn-controller to read heap memory beyond the valid packet data and include it in the     ICMP response sent back to the VM. (CVE-2026-5265)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323095	SUSE SLES15: libopenvswitch-2_14-0 / libovn-20_06-0 / openvswitch / etc (SUSE-SU-2026:2481-1)	Nessus	SuSE Local Security Checks	high
323068	SUSE SLES15: libopenvswitch-3_1-0 / libovn-23_03-0 / openvswitch / etc (SUSE-SU-2026:2475-1)	Nessus	SuSE Local Security Checks	high
322936	SUSE SLES15: libopenvswitch-3_1-0 / libovn-23_03-0 / openvswitch3 / etc (SUSE-SU-2026:2476-1)	Nessus	SuSE Local Security Checks	high
321921	SUSE SLES15: libopenvswitch-3_5-0 / libovn-25_03-0 / openvswitch / etc (SUSE-SU-2026:2463-1)	Nessus	SuSE Local Security Checks	high
319577	RHEL 10 : ovn25.03 (RHSA-2026:22110)	Nessus	Red Hat Local Security Checks	high
318073	RHEL 10 : ovn25.09 (RHSA-2026:22111)	Nessus	Red Hat Local Security Checks	high
311125	RHEL 9 : ovn25.03 (RHSA-2026:11701)	Nessus	Red Hat Local Security Checks	high
311113	RHEL 9 : ovn24.03 (RHSA-2026:11700)	Nessus	Red Hat Local Security Checks	high
311112	RHEL 9 : ovn23.09 (RHSA-2026:11698)	Nessus	Red Hat Local Security Checks	high
311110	RHEL 8 : ovn23.06 (RHSA-2026:11695)	Nessus	Red Hat Local Security Checks	high
311070	RHEL 9 : ovn23.06 (RHSA-2026:11696)	Nessus	Red Hat Local Security Checks	high
311068	RHEL 8 : ovn-2021 (RHSA-2026:11694)	Nessus	Red Hat Local Security Checks	high
311067	RHEL 9 : ovn25.09 (RHSA-2026:11702)	Nessus	Red Hat Local Security Checks	high
307605	Linux Distros Unpatched Vulnerability : CVE-2026-5265	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-5265

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

medium