PT-2026-6837 · Vmware · Antreas

Antoninbas · Published 2026-02-06 · Updated 2026-03-03 · CVE-2026-25804

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Antrea versions prior to 2.3.2 Antrea versions prior to 2.4.3

Description Antrea, a Kubernetes networking solution, contains a flaw in its network policy priority assignment system. A uint16 arithmetic overflow bug leads to incorrect OpenFlow priority calculations when managing a significant number of policies with diverse priority values. This can result in incorrect traffic enforcement.

Recommendations Update to Antrea version 2.3.2 or later. Update to Antrea version 2.4.3 or later.

Exploit

Fix

Allocation of Resources Without Limits

Improper Authentication

Weakness Enumeration

CWE-770

CWE-287

Related Identifiers

CVE-2026-25804

GHSA-86X4-WP9F-WRR9

GO-2026-4461

SUSE-SU-2026:0757-1

Affected Products

Antreas

References · 123

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25804.json · Exploit
• https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9 · Vendor Advisory
• https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa · Patch
• https://github.com/antrea-io/antrea/pull/7496 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25804 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25804 · Security Note
• https://osv.dev/vulnerability/GHSA-86x4-wp9f-wrr9 · Vendor Advisory
• https://github.com/antrea-io/antrea · Note
• https://github.com/antrea-io/antrea/blob/main/docs/antrea-network-policy.md · Note
• https://suse.com/security/cve/CVE-2026-23989 · Note
• https://suse.com/security/cve/CVE-2017-18917 · Note
• https://suse.com/security/cve/CVE-2023-43636 · Note
• https://suse.com/security/cve/CVE-2026-27017 · Note