---
id: CVE-2024-2182
title: 'Ovn: insufficient validation of bfd packets may lead to denial of service'
summary: >-
  A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD
  is used between hypervisors for high availability, an attacker can inject
  specially crafted BFD packets from inside unprivileged workloads, including
  virtual m…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-346
vendor: Red Hat
product: ovn
affected:
  - ovn >= 20.03.0 < *
  - ovn23.06 (all versions)
  - ovn22.12 (all versions)
  - ovn22.03 (all versions)
  - ovn23.03 (all versions)
  - ovn-2021 (all versions)
  - ovn23.09 (all versions)
  - ovn23.06 (all versions)
  - ovn22.12 (all versions)
  - ovn22.03 (all versions)
  - ovn23.03 (all versions)
  - ovn25.03 (all versions)
  - ovn25.09 (all versions)
  - ovn26.03 (all versions)
  - ovn2.11
  - ovn2.12
  - ovn2.13
  - ovn2.11
  - ovn2.12
  - ovn2.13
  - ovn22.06
  - ovn22.09
  - ovn-2021 (all versions)
  - ovn22.06
  - ovn22.09
  - ovn24.03 (all versions)
  - ovn24.09 (all versions)
  - ovn25.03 (all versions)
  - ovn25.09 (all versions)
  - ovn26.03 (all versions)
  - ovn22.06 (all versions)
  - ovn22.09 (all versions)
  - ovn22.12 (all versions)
  - ovn23.03 (all versions)
  - ovn23.06 (all versions)
  - ovn23.09 (all versions)
  - ovn24.03 (all versions)
  - ovn24.09 (all versions)
  - ovn2.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-03-13T14:24:40.610508Z'
published: '2024-03-12'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T10:24:39.836Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-2182'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:1385'
    label: 'RHSA-2024:1385'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1386'
    label: 'RHSA-2024:1386'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1387'
    label: 'RHSA-2024:1387'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1388'
    label: 'RHSA-2024:1388'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1390'
    label: 'RHSA-2024:1390'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1391'
    label: 'RHSA-2024:1391'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1392'
    label: 'RHSA-2024:1392'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1393'
    label: 'RHSA-2024:1393'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1394'
    label: 'RHSA-2024:1394'
  - url: 'https://access.redhat.com/errata/RHSA-2024:4035'
    label: 'RHSA-2024:4035'
  - url: 'https://access.redhat.com/security/cve/CVE-2024-2182'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2267840'
    label: RHBZ#2267840
  - url: 'https://mail.openvswitch.org/pipermail/ovs-announce/2024-March/000346.html'
  - url: 'https://www.openwall.com/lists/oss-security/2024/03/12/5'
tags:
  - cve.org
epss: 0.00783
epssPercentile: 0.55174
ingestedAt: '2026-10-19T12:27:23.821Z'
---

## Overview

A flaw was found in the Open Virtual Network (OVN). In OVN clusters where BFD is used between hypervisors for high availability, an attacker can inject specially crafted BFD packets from inside unprivileged workloads, including virtual machines or containers, that can trigger a denial of service.

## Affected

- `ovn >= 20.03.0 < *`
- `ovn23.06 (all versions)`
- `ovn22.12 (all versions)`
- `ovn22.03 (all versions)`
- `ovn23.03 (all versions)`
- `ovn-2021 (all versions)`
- `ovn23.09 (all versions)`
- `ovn23.06 (all versions)`
- `ovn22.12 (all versions)`
- `ovn22.03 (all versions)`
- `ovn23.03 (all versions)`
- `ovn25.03 (all versions)`
- `ovn25.09 (all versions)`
- `ovn26.03 (all versions)`
- `ovn2.11`
- `ovn2.12`
- `ovn2.13`
- `ovn2.11`
- `ovn2.12`
- `ovn2.13`
- `ovn22.06`
- `ovn22.09`
- `ovn-2021 (all versions)`
- `ovn22.06`
- `ovn22.09`
- `ovn24.03 (all versions)`
- `ovn24.09 (all versions)`
- `ovn25.03 (all versions)`
- `ovn25.09 (all versions)`
- `ovn26.03 (all versions)`
- `ovn22.06 (all versions)`
- `ovn22.09 (all versions)`
- `ovn22.12 (all versions)`
- `ovn23.03 (all versions)`
- `ovn23.06 (all versions)`
- `ovn23.09 (all versions)`
- `ovn24.03 (all versions)`
- `ovn24.09 (all versions)`
- `ovn2.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.