CVE-2019-25076 describes a denial-of-service vulnerability in Open vSwitch versions 2.x through 2.17.2 and 3.0.0. Attackers can exploit the Tuple Space Search (TSS) algorithm by sending crafted packet data, leading to excessive evaluation time within the MegaFlow cache and causing delays in legitimate traffic. This vulnerability has a CVSS score of 5.8 (Medium), indicating a low-complexity attack that can be launched remotely without authentication, resulting in a low impact on availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.0.0, <= 2.17.2CPE matchmatch criteria | cpe:2.3:a:openvswitch:openvswitch:*:*:*:*:*:*:*:* | ||
3.0.0CPE matchmatch criteria | cpe:2.3:a:openvswitch:openvswitch:3.0.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x through 2.17.2 and 3.0.0 allows remote attackers to cause a denial of service (delays of legitimate traffic) via crafted packet data that requires excessive evaluation time within the packet classification algorithm for the MegaFlow cache aka a Tuple Space Explosion (TSE) attack.
Sep 13, 2022openvswitch: DoS via crafted packet
Sep 9, 2022