What’s Vulnerable › Vulnerabilities

CVE-2026-25804: Antrea has invalid enforcement order for network policy rules caused by integer overflow

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-06 · updated 2026-06-17
• Weakness: CWE-287

Description

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.

Affected products

• antrea-io antrea: before 2.3.2; from 2.4.0 before 2.4.3 — fixed in 2.3.2, 2.4.3

How to fix

Upgrade to a fixed version: antrea-io antrea 2.3.2, 2.4.3. Check the vendor advisory for mitigations.

References

• https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa
• https://github.com/antrea-io/antrea/pull/7496
• https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9

Get alerted when CVE-2026-25804 or the next vulnerability affects your stack