by Kastro
Paper/Archive/CVE-2026-25804

CVE-2026-25804

antrea-io antrea — Antrea has invalid enforcement order for network policy rules caused by integer overflow

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.8.428 × 208.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.

Affected

ProductAffectedFixed inSource
antrea< 2.3.2–CNA
antrea>= 2.4.0, < 2.4.3–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GitHub_M (CNA)8.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9refgithub.com/antrea-io/antrea/pull/7496refgithub.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa