7.8

CVE-2020-35498: debian debian_linux Uncontrolled Resource Consumption

Modified
AliasesSUSE-SU-2021:0436-1SUSE-SU-2021:0439-1SUSE-SU-2021:0440-1
Published 11-02-2021Last modified 23-04-2025

Vulnerability summary

CVE-2020-35498 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 8.03% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 8% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v2.0 (NVD)
EPSS score
8.03%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8
DLA-2571-1RHSA-2021:0497RHSA-2021:0834RHSA-2021:0835RHSA-2021:0837RHSA-2021:1050

Timeline

  1. 11-02-2021
    PublishedVulnerability first disclosed.
  2. 23-04-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

8.03%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

No change 0.00 pp

From 8.03% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse36 products
  • openvswitch-dpdk&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 2.5.11-25.29.1
  • openvswitch-dpdk&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 2.5.11-25.29.1
  • openvswitch-dpdk&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 2.5.11-25.29.1
  • openvswitch-dpdk&distro=SUSE OpenStack Cloud 7< 2.5.11-25.29.1
  • openvswitch&distro=HPE Helion OpenStack 8< 2.7.12-3.39.1
Debian2 products
  • openvswitch< 2.10.7+ds1-0+deb10u1 | < 2.15.0~git20210104.def6eb1ea+dfsg1-5
  • debian_linuxEOL9.0 | 10.0
Alpine1 product
  • openvswitch≥ 2.5.0, < 2.12.3-r0
Fedoraproject1 product
Opensuse1 product
  • openvswitch&distro=openSUSE Leap 15.2< 2.13.2-lp152.3.12.1
Openvswitch1 product
  • openvswitch≥ 2.5.0, < 2.5.12 | ≥ 2.6.0, < 2.6.10 | ≥ 2.7.0, < 2.7.13 | ≥ 2.8.0, < 2.8.11 | ≥ 2.9.0, < 2.9.9 | ≥ 2.10.0, < 2.10.7 | ≥ 2.11.0, < 2.11.6 | ≥ 2.12.0, < 2.12.3 | ≥ 2.13.0, < 2.13.3 | ≥ 2.14.0, < 2.14.2
Ubuntu1 product
  • openvswitch< 2.5.9-0ubuntu0.16.04.3 | < 2.9.8-0ubuntu0.18.04.2 | < 2.13.1-0ubuntu0.20.04.4

7 vendors · 43 products

References

22 links
Show all 22 references