High, CVSS 8.0GoPublished
Antrea has invalid enforcement order for network policy rules caused by integer overflow
CVE-2026-25804 · GHSA-86x4-wp9f-wrr9
- Affected
- Go antrea.io/antrea < 2.3.2; >= 2.4.0, < 2.4.3
- Fixed in
- 2.4.32.3.2· Vendor fix available
- Issue
- Impact Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. If a user creates a large number of Antrea NetworkPolicies (ANP or ACNP) with varying priorities, some rules with lower logical priorities (higher numerical priority values) may take precedence over rules with higher logical priorities (lower numerical priority values). Traffic that should be denied by the configured Antrea NetworkPolicies may end up being allowed, potentially letting an attacker access a sensitive service. Traffic that should be allowed by the configured Antrea NetworkPolicies may end up being denied, breaking applications and potentially opening the door for denial-of-service attacks. The Antrea NetworkPolicy system comes with support for priority Tiers. Rules defined within a Tier cannot…
Recommended action: Upgrade to 2.4.3 or 2.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.