A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of sensitive information stored in heap memory, which is then returned to the attacker's virtual machine port.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:22111 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11701 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11700 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11698 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11695 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11696 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11694 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:11702 advisory.

    OVN, the Open Virtual Network, is a system to support virtual network abstraction.  OVN complements the     existing capabilities of OVS to add native support for virtual network abstractions, such as virtual L2     and L3 overlays and security groups.

    Security Fix(es):

    * ovn: ovn: Heap Over-Read in ICMP Error Response Generation - security issue (CVE-2026-5265)

    * ovn: OVN: Information disclosure via crafted DHCPv6 packets (CVE-2026-5367)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in OVN (Open Virtual Network). A remote attacker, by sending crafted DHCPv6 (Dynamic Host     Configuration Protocol for IPv6) SOLICIT packets with an inflated Client ID length, could cause the ovn-     controller to read beyond the bounds of a packet. This out-of-bounds read can lead to the disclosure of     sensitive information stored in heap memory, which is then returned to the attacker's virtual machine     port. (CVE-2026-5367)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318073	RHEL 10 : ovn25.09 (RHSA-2026:22111)	Nessus	Red Hat Local Security Checks	high
311125	RHEL 9 : ovn25.03 (RHSA-2026:11701)	Nessus	Red Hat Local Security Checks	high
311113	RHEL 9 : ovn24.03 (RHSA-2026:11700)	Nessus	Red Hat Local Security Checks	high
311112	RHEL 9 : ovn23.09 (RHSA-2026:11698)	Nessus	Red Hat Local Security Checks	high
311110	RHEL 8 : ovn23.06 (RHSA-2026:11695)	Nessus	Red Hat Local Security Checks	high
311070	RHEL 9 : ovn23.06 (RHSA-2026:11696)	Nessus	Red Hat Local Security Checks	high
311068	RHEL 8 : ovn-2021 (RHSA-2026:11694)	Nessus	Red Hat Local Security Checks	high
311067	RHEL 9 : ovn25.09 (RHSA-2026:11702)	Nessus	Red Hat Local Security Checks	high
307608	Linux Distros Unpatched Vulnerability : CVE-2026-5367	Nessus	Misc.	high

Detections

Analytics

CVE-2026-5367

high

Tenable Plugins

high

high

high

high

high

high

high

high

high