CVE-2026-25804 Antrea has invalid enforcement order for network policy rules caused by integer overflow
An integer overflow in Antrea's network policy priority calculation can lead to incorrect traffic enforcement, bypassing intended security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25804?
CVE-2026-25804 is a high-severity vulnerability in antrea-io antrea, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.
Which versions are affected by CVE-2026-25804?
5 open source packages ship an affected version, including antrea.io/antrea. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
antrea.io/antrea Go | All versions | None |
antrea.io/antrea Go | All versions | 2.3.2 |
antrea.io/antrea Go | All versions | 2.3.2 |
antrea.io/antrea Go | From 2.4.0 | 2.4.3 |
antrea.io/antrea Go | From 2.4.0 | 2.4.3 |
Products include Linuxfoundation Antrea.
How do I fix CVE-2026-25804?
Upgrade antrea.io/antrea to a fixed version for your release line: 2.3.2 or 2.4.3.
Is CVE-2026-25804 being exploited?
There is no known exploitation of CVE-2026-25804 in the wild and no public exploit code.
Other vulnerabilities in antrea-io antrea
Sources
Also known as GHSA-86x4-wp9f-wrr9, GO-2026-4461.