CVE-2021-3905

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-23 · updated 2026-06-17
Weakness: CWE-401

Description

A memory leak was found in Open vSwitch (OVS) during userspace IP fragmentation processing. An attacker could use this flaw to potentially exhaust available memory by keeping sending packet fragments.

Affected products

Canonical Ubuntu Linux: 21.10
Fedoraproject Fedora: 35
Openvswitch: before 2.17.0 — fixed in 2.17.0
RedHat Enterprise Linux Fast Datapath: 7.0, 8.0

How to fix

Upgrade to a fixed version: Openvswitch 2.17.0. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/CVE-2021-3905
https://bugzilla.redhat.com/show_bug.cgi?id=2019692
https://github.com/openvswitch/ovs-issues/issues/226
https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349
https://security.gentoo.org/glsa/202311-16
https://ubuntu.com/security/CVE-2021-3905
https://access.redhat.com/security/cve/CVE-2021-3905
https://bugzilla.redhat.com/show_bug.cgi?id=2019692
https://github.com/openvswitch/ovs-issues/issues/226
https://github.com/openvswitch/ovs/commit/803ed12e31b0377c37d7aa8c94b3b92f2081e349
https://security.gentoo.org/glsa/202311-16
https://ubuntu.com/security/CVE-2021-3905

Get alerted when CVE-2021-3905 or the next vulnerability affects your stack