CVE-2024-22563 Denial of service in n/a

High 7.5 Published 19 Jan 2024 Updated 2 Jun 2025

A memory leak in Open vSwitch allows attackers to cause a denial of service by exhausting system memory.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-22563?

CVE-2024-22563 is a high-severity denial of service vulnerability in n/a, published on 19 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c.

Weakness: CWE-401

Which versions are affected by CVE-2024-22563?

It affects 1 product.

Linux distribution packages (19)

`openvswitch` SUSE:Enterprise Storage 7.1	All versions	`2.14.2-150300.19.17.1`
`openvswitch` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`2.13.2-150200.9.31.1`
`openvswitch` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	All versions	`2.14.2-150300.19.17.1`
`openvswitch` SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS	All versions	`2.14.2-150400.24.20.1`
`openvswitch` SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS	All versions	`2.14.2-150400.24.20.1`
`openvswitch` SUSE:Linux Enterprise Module for Legacy 15 SP5	All versions	`2.14.2-150400.24.20.1`
`openvswitch` SUSE:Linux Enterprise Module for Package Hub 15 SP5	All versions	`2.11.5-150100.3.24.1`
`openvswitch` SUSE:Linux Enterprise Module for Package Hub 15 SP5	All versions	`2.14.2-150400.24.20.1`
`openvswitch` SUSE:Linux Enterprise Server 12 SP5	All versions	`2.11.5-3.21.1`
`openvswitch` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`2.13.2-150200.9.31.1`
`openvswitch` SUSE:Linux Enterprise Server 15 SP3-LTSS	All versions	`2.14.2-150300.19.17.1`
`openvswitch` SUSE:Linux Enterprise Server 15 SP4-LTSS	All versions	`2.14.2-150400.24.20.1`
`openvswitch` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`2.11.5-3.21.1`
`openvswitch` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`2.13.2-150200.9.31.1`
`openvswitch` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	All versions	`2.14.2-150300.19.17.1`
`openvswitch` SUSE:Linux Enterprise Server for SAP Applications 15 SP4	All versions	`2.14.2-150400.24.20.1`
`openvswitch` SUSE:Manager Proxy 4.3	All versions	`2.14.2-150400.24.20.1`
`openvswitch` SUSE:Manager Server 4.3	All versions	`2.14.2-150400.24.20.1`
`openvswitch` openSUSE:Leap 15.5	All versions	`2.14.2-150400.24.20.1`

Products include Openvswitch Openvswitch.

How do I fix CVE-2024-22563?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-22563 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-22563 exists.

Sources

Also known as DEBIAN-CVE-2024-22563, GHSA-79hq-vf7m-fqvr, SUSE-SU-2024:0462-1, SUSE-SU-2024:0524-1, SUSE-SU-2024:0526-1, SUSE-SU-2024:0544-1 and 2 more.