Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.
PUBLISHED5.2CWE-287CWE-770
Antrea has invalid enforcement order for network policy rules caused by integer overflow
Problem type
Affected products
antrea-io
antrea
< 2.3.2 - AFFECTED
>= 2.4.0, < 2.4.3 - AFFECTED
References
https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9
https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9
https://github.com/antrea-io/antrea/pull/7496
https://github.com/antrea-io/antrea/pull/7496
https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa
https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa
GitHub Security Advisories
GHSA-86x4-wp9f-wrr9
Antrea has invalid enforcement order for network policy rules caused by integer overflow
https://github.com/advisories/GHSA-86x4-wp9f-wrr9Impact
Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement.
If a user creates a large number of Antrea NetworkPolicies (ANP or ACNP) with varying priorities, some rules with lower logical priorities (higher numerical priority values) may take precedence over rules with higher logical priorities (lower numerical priority values). Traffic that should be denied by the configured Antrea NetworkPolicies may end up being allowed, potentially letting an attacker access a sensitive service. Traffic that should be allowed by the configured Antrea NetworkPolicies may end up being denied, breaking applications and potentially opening the door for denial-of-service attacks.
The Antrea NetworkPolicy system comes with support for priority Tiers. Rules defined within a Tier cannot take precedence over rules defined in higher priority Tiers. Some users / roles may only be authorized to define within specific Tiers. This security vulnerability enables such users to intentionally "escape" their Tier and override rules in higher priority Tiers.
Antrea deployments that only use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.
Patches
https://github.com/antrea-io/antrea/pull/7496 Antrea v2.5.0 Antrea v2.4.3 Antrea v2.3.2
Workarounds
Antrea deployments that only use upstream Kubernetes NetworkPolicies - and do not use Antrea NetworkPolicies - are not affected.
For users leveraging Antrea NetworkPolicies, there is no way to fix or remediate the vulnerability without upgrading.
Resources
https://gist.github.com/antoninbas/c429cc3e5bb8479ba7ff38fd6fde59d9 https://github.com/antrea-io/antrea/pull/7496 https://github.com/antrea-io/antrea/blob/main/docs/antrea-network-policy.md
github.com
https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9
github.com
https://github.com/antrea-io/antrea/pull/7496
gist.github.com
https://gist.github.com/antoninbas/c429cc3e5bb8479ba7ff38fd6fde59d9
github.com
https://github.com/antrea-io/antrea/blob/main/docs/antrea-network-policy.md
nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-25804
github.com
https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa
github.com
https://github.com/advisories/GHSA-86x4-wp9f-wrr9
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-25804Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-25804",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-02-06T22:58:35.041Z",
"dateReserved": "2026-02-05T19:58:01.641Z",
"datePublished": "2026-02-06T22:58:35.041Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-02-06T22:58:35.041Z"
},
"title": "Antrea has invalid enforcement order for network policy rules caused by integer overflow",
"descriptions": [
{
"lang": "en",
"value": "Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3."
}
],
"affected": [
{
"vendor": "antrea-io",
"product": "antrea",
"versions": [
{
"version": "< 2.3.2",
"status": "affected"
},
{
"version": ">= 2.4.0, < 2.4.3",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-287: Improper Authentication",
"cweId": "CWE-287",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"cweId": "CWE-770",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9",
"name": "https://github.com/antrea-io/antrea/security/advisories/GHSA-86x4-wp9f-wrr9",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/antrea-io/antrea/pull/7496",
"name": "https://github.com/antrea-io/antrea/pull/7496",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa",
"name": "https://github.com/antrea-io/antrea/commit/86c4b6010f3be536866f339b632621c23d7186fa",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{}
]
}
}
}