CVE-2026-34956 — Open VSwitch Denial of Service

title: CVE-2026-34956 - Open vSwitch FTP EPASV DoS Exploit Attempt
id: scw-2026-05-05-ai-1
status: experimental
level: critical
description: |
  Detects potential exploitation of CVE-2026-34956. This rule looks for FTP traffic on port 21 containing an EPASV command, which is part of the exploit chain that leads to a heap access error and potential Denial of Service in Open vSwitch when configured with FTP helpers over the userspace datapath. The exploit specifically involves an EPASV command with a parameter exceeding 255 characters, which this rule aims to capture by identifying the command itself within FTP traffic.
author: SCW Feed Engine (AI-generated)
date: 2026-05-05
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-34956/
tags:
  - attack.impact
  - attack.t1499
logsource:
    category: firewall
detection:
  selection:
      dst_port:
          - 21
      cs-uri-query|contains:
          - 'EPASV'
      cs-uri|contains:
          - 'FTP'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse